Free BCS Practitioner Certificate in Data Protection Practice Questions

Sample Practice Questions

Try these 10 sample questions from the BCS Practitioner Certificate in Data Protection practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A data protection specialist reviews the security objectives that support privacy. Which objective is primarily concerned with preventing unauthorized access to information?

   1. A.ConfidentialityCorrect answer: A
   2. B.Integrity
   3. C.Availability
   4. D.Accountability

   Explanation: NIST states that "confidentiality, which is focused on preventing unauthorized access to information" is distinct from privacy risks arising within an authorized perimeter. The other options concern different properties or responsibilities.

   Reference: An Introduction to Privacy Engineering and Risk Management in Federal Systems — Section 3.1.1.3, Disassociability

2. 2For customer data governed by the UK GDPR, a US retailer alone decides why the data will be used and which essential methods will be used to process it. An external company processes the data on the retailer's behalf. What is the retailer's role for this processing?

   1. A.ControllerCorrect answer: A
   2. B.Processor
   3. C.Joint controller
   4. D.Third party

   Explanation: Article 4 defines the controller as the body which "determines the purposes and means of the processing of personal data". The retailer makes those decisions, while the external company processes on its behalf.

   Reference: United Kingdom General Data Protection Regulation — Article 4(7)–(9)

3. 3In its UK GDPR compliance program, an American organization acts as controller and hires a processor and a data protection officer. Which role remains responsible for demonstrating compliance with the Article 5 processing principles?

   1. A.The controllerCorrect answer: A
   2. B.The processor
   3. C.The data protection officer
   4. D.The UK representative

   Explanation: Article 5 states, "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1". Engaging other roles does not transfer that Article 5 accountability.

   Reference: United Kingdom General Data Protection Regulation — Article 5(2)

4. 4An outsourced processor in the US, subject to the UK GDPR, wants to engage another processor for work carried out on a controller's behalf. Whose prior specific or general written authorization must it obtain?

   1. A.The controller's authorizationCorrect answer: A
   2. B.The data subject's authorization
   3. C.The regulator's authorization
   4. D.The data protection officer's authorization

   Explanation: Article 28 provides that "The processor shall not engage another processor without prior specific or general written authorisation of the controller." General authorization also requires notice of intended changes and an opportunity to object.

   Reference: United Kingdom General Data Protection Regulation — Article 28(2)

5. 5A customer's date of birth appears inaccurately in a US controller's record subject to the UK GDPR. The customer asks the controller to correct it. Which individual right is the customer exercising?

   1. A.RectificationCorrect answer: A
   2. B.Data portability
   3. C.Restriction of processing
   4. D.Erasure

   Explanation: Article 16 grants the individual the right to obtain "the rectification of inaccurate personal data concerning him or her". The request seeks correction of an inaccurate record.

   Reference: United Kingdom General Data Protection Regulation — Article 16

6. 6A US business subject to the UK GDPR asks an industry association to direct the UK supervisory authority's decision in an investigation. Which property requires the authority to make its regulatory decision without taking such instructions?

   1. A.Regulatory independenceCorrect answer: A
   2. B.Procedural transparency
   3. C.Regulatory accountability
   4. D.International cooperation

   Explanation: Article 52 requires the Commission to "remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody" in performing its regulatory tasks and powers. That is its independence.

   Reference: United Kingdom General Data Protection Regulation — Article 52(1)–(2)

7. 7A US provider offers an information society service directly to children in the UK and relies on consent under the UK GDPR. Assuming the service is not exempt and the consent is otherwise valid, what is the minimum age at which the child's own consent can satisfy Article 8 without parental authorization?

   1. A.12 years
   2. B.13 yearsCorrect answer: B
   3. C.16 years
   4. D.18 years

   Explanation: The BCS syllabus describes consent for an online service to a child as "limiting this to children aged 13 and over, when in the UK". Article 8 supplies the parental-authorization condition below that threshold.

   Reference: BCS Practitioner Certificate in Data Protection Syllabus v9.9 — Section 10.1, Guidance, printed page 23

8. 8A US data protection adviser reviews four UK GDPR processing arrangements. Sensitive data here means special-category or criminal-offence data. Assume no appointment requirement applies beyond Article 37(1). Which arrangement requires a data protection officer?

   1. A.A public authority processing data while delivering a public serviceCorrect answer: A
   2. B.A court processing data while acting in its judicial capacity
   3. C.A tribunal processing data while acting in its judicial capacity
   4. D.A private company without large-scale monitoring or sensitive-data processing

   Explanation: Article 37 requires designation where "the processing is carried out by a public authority or body, except for courts" and tribunals acting in their judicial capacity. The private company does not meet the large-scale criteria specified in the stem.

   Reference: United Kingdom General Data Protection Regulation — Article 37(1)(a)–(c)

9. 9A US employer subject to the UK GDPR proposes relying on workers' consent for workplace monitoring. Workers believe that declining could affect their employment. Which requirement for valid consent is most directly in doubt?

   1. A.Freely givenCorrect answer: A
   2. B.Specific
   3. C.Informed
   4. D.Unambiguous

   Explanation: The ICO states, "A person must freely give their consent for it to be valid" and explains that a power imbalance can make workers feel they have no choice. The perceived employment consequences make the freedom of the choice uncertain.

   Reference: Data protection and monitoring workers — How do we identify a lawful basis? — Consent

10. 10An AI screening system used by an American organization subject to the UK GDPR labels a qualified job applicant as unqualified, causing the applicant to miss an interview. Which error describes this outcome?

    1. A.False negativeCorrect answer: A
    2. B.False positive
    3. C.True negative
    4. D.True positive

    Explanation: The ICO explains, "If it produces a false negative, a qualified candidate will miss an employment opportunity". The system failed to identify a candidate who met the condition it was intended to detect.

    Reference: What do we need to know about accuracy and statistical accuracy? — How should we define and prioritise different statistical accuracy measures?