Free EXIN Privacy & Data Protection Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the EXIN Privacy & Data Protection Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which idea is part of privacy as described by the European Data Protection Supervisor?

   1. A.Autonomy and control over information about oneselfCorrect answer: A
   2. B.Control over every other person's personal information
   3. C.A requirement to conceal all information in every context
   4. D.An entitlement to determine another person's private choices

   Explanation: "privacy or the right to a private life, to be autonomous, in control of information about yourself, to be let alone, plays a pivotal role." The source connects privacy with autonomy and control over one's own information.

   Reference: Data Protection — What is Privacy?

2. 2When are two organizations joint controllers under GDPR Article 26?

   1. A.When both independently process unrelated data for unrelated purposes
   2. B.When they jointly determine the purposes and means of processingCorrect answer: B
   3. C.When one receives data solely as a processor acting on instructions
   4. D.When both are subject to the same supervisory authority

   Explanation: "Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers." Joint determination of purposes and means establishes this role.

   Reference: General Data Protection Regulation — Article 26(1)

3. 3During which stages should an organization address documentation, storage and quality assurance when managing a data lifecycle?

   1. A.Only during the initial collection of the data
   2. B.Only after the data have been archived
   3. C.At each relevant stage of the lifecycleCorrect answer: C
   4. D.Only when a data subject submits an access request

   Explanation: "Questions of documentation, storage, quality assurance, and ownership need to be answered for each stage of the lifecycle." The USGS explains that management needs recur across lifecycle stages.

   Reference: Data Lifecycle — USGS Science Data Lifecycle Model

4. 4Under GDPR Article 47, what must approved binding corporate rules require of the members of the relevant group?

   1. A.The rules need bind only the EU member that applied for approval.
   2. B.The rules must bind employees but need not bind their employers.
   3. C.The rules must be legally binding on the members concerned, including their employees.Correct answer: C
   4. D.The rules may be voluntary once the supervisory authority has approved them.

   Explanation: "are legally binding and apply to and are enforced by every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees" Article 47 requires legally binding rules applied and enforced across the members concerned.

   Reference: General Data Protection Regulation — Article 47(1)(a)

5. 5When does GDPR Article 35(1) require a controller to carry out a DPIA?

   1. A.Before any processing, even where the risk is demonstrably low
   2. B.After processing likely to result in high risk has been completed
   3. C.After a data breach, regardless of the risk from the planned processing
   4. D.Before processing likely to result in high risk to individuals' rights and freedomsCorrect answer: D

   Explanation: "is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment" The assessment is required before processing likely to result in high risk.

   Reference: General Data Protection Regulation — Article 35(1)

6. 6Which provision of the EU Charter expressly protects personal data?

   1. A.Article 7, concerning respect for private and family life
   2. B.Article 8, concerning protection of personal dataCorrect answer: B
   3. C.Article 6, concerning the right to liberty and security
   4. D.Article 11, concerning freedom of expression and information

   Explanation: "The Charter contains an explicit right to the protection of personal data (Article 8)." The Charter separately addresses private life in Article 7.

   Reference: Data Protection — The Right to Data Protection

7. 7An external payroll provider processes employee data on a company's behalf. Which GDPR role does the provider perform for that processing?

   1. A.Controller
   2. B.Data subject
   3. C.ProcessorCorrect answer: C
   4. D.Supervisory authority

   Explanation: "processes personal data on behalf of the controller" The provider processes on behalf of the company, which is the processor's role.

   Reference: General Data Protection Regulation — Article 4(8)

8. 8In the context of web browsing, what is a website cookie?

   1. A.A small file stored exclusively on the website's server
   2. B.A small file permanently embedded in the browser's program code
   3. C.A small file stored on every website the user visits
   4. D.A small file stored on a user's deviceCorrect answer: D

   Explanation: "Cookies are small files stored on a device, such as a computer, a mobile device or any other device that can store information." A cookie is stored on a device such as a computer or mobile device.

   Reference: Data protection guide for small business: FAQ — What are cookies?

9. 9Which body approves binding corporate rules under GDPR Article 47?

   1. A.The European Commission acting instead of the supervisory authority
   2. B.The controller's designated data protection officer
   3. C.The European Data Protection Board acting instead of the competent authority
   4. D.The competent supervisory authorityCorrect answer: D

   Explanation: "The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism" Approval is by the competent supervisory authority under the consistency mechanism.

   Reference: General Data Protection Regulation — Article 47(1)

10. 10Which activity is specifically identified by GDPR Article 35(3) as requiring a DPIA?

    1. A.Systematic monitoring of a publicly accessible area on a large scaleCorrect answer: A
    2. B.Monitoring a public area on a small scale regardless of other circumstances
    3. C.Processing any personal data by automated means regardless of its effects
    4. D.Any evaluation of personal aspects regardless of whether decisions have significant effects

    Explanation: "a systematic monitoring of a publicly accessible area on a large scale" Article 35(3)(c) identifies systematic large-scale monitoring of a publicly accessible area.

    Reference: General Data Protection Regulation — Article 35(3)(c)