Free PECB Certified GDPR Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified GDPR Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which identifying relationship brings information within the GDPR definition of personal data?

   1. A.It relates to an identified or indirectly identifiable natural personCorrect answer: A
   2. B.It contains a person's name in every case
   3. C.It is recorded exclusively in an automated system
   4. D.It relates to a legal person rather than a natural person

   Explanation: Article 4 defines personal data as "any information relating to an identified or identifiable natural person" and recognizes indirect identification. A natural person need not be named directly.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 4(1)

2. 2A person asks whether a controller processes personal data about them. Which GDPR right supports obtaining that confirmation?

   1. A.The right to data portability
   2. B.The right of accessCorrect answer: B
   3. C.The right to restrict processing
   4. D.The right to erasure

   Explanation: Article 15 gives the data subject the right to obtain "confirmation as to whether or not personal data concerning him or her are being processed".

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 15(1)

3. 3Which characteristic distinguishes a GDPR controller from a processor?

   1. A.The body that determines purposes and means of processingCorrect answer: A
   2. B.The body that processes personal data on a controller's behalf
   3. C.The body that receives personal data from a controller
   4. D.The body that monitors compliance as a supervisory authority

   Explanation: Article 4 describes a controller as the body which "determines the purposes and means of the processing of personal data". A processor processes on the controller's behalf.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 4(7)

4. 4A controller holds a customer's inaccurate address. Which right allows the customer to have it corrected?

   1. A.Restriction
   2. B.Data portability
   3. C.RectificationCorrect answer: C
   4. D.Objection

   Explanation: Article 16 provides the right to obtain "the rectification of inaccurate personal data concerning him or her" without undue delay.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 16

5. 5Which function defines a processor's role under the GDPR?

   1. A.Determining purposes and means of processing
   2. B.Processing personal data on behalf of a controllerCorrect answer: B
   3. C.Monitoring application of the regulation as an authority
   4. D.Representing a non-EU controller under Article 27

   Explanation: Article 4 defines a processor as a body "which processes personal data on behalf of the controller". This relationship differs from determining processing purposes as controller.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 4(8)

6. 6A person objects to the processing of their personal data for direct marketing. What must the controller do for that purpose?

   1. A.Transfer the marketing data to a different controller
   2. B.Continue marketing if the controller has a commercial interest
   3. C.Continue marketing until the next annual review
   4. D.Stop processing those data for direct marketingCorrect answer: D

   Explanation: Article 21 states "Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." Other processing purposes must be assessed separately.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 21(3)

7. 7What does the GDPR mean by restriction of processing?

   1. A.Marking stored personal data to limit their future processingCorrect answer: A
   2. B.Deleting all records so that no personal data remain
   3. C.Reusing personal data to evaluate a person's behavior
   4. D.Disclosing personal data to an authorized recipient

   Explanation: Article 4 defines restriction as "the marking of stored personal data with the aim of limiting their processing in the future". It is not itself erasure or disclosure.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 4(3)

8. 8When Article 20 data portability applies, what format must be provided to the data subject?

   1. A.Any format readable only by the original controller's staff
   2. B.A structured, commonly used and machine-readable formatCorrect answer: B
   3. C.A handwritten summary without the personal data provided
   4. D.A format usable only after permission from the original controller

   Explanation: Article 20 specifies "a structured, commonly used and machine-readable format" for the covered personal data. It applies subject to the article's legal-basis and automated-processing conditions.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 20(1)

9. 9Which description best matches profiling under the GDPR?

   1. A.Storing personal records in an ordered filing system
   2. B.Using automated processing to evaluate personal aspectsCorrect answer: B
   3. C.Marking stored records to limit future processing
   4. D.Correcting inaccurate details about a data subject

   Explanation: Article 4 describes profiling as "automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects". Storage, restriction, and correction alone do not establish that evaluation.

   Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 4(4)

10. 10A controller receives a request under Articles 15–22. What is the ordinary maximum period to inform the person about the action taken, before any permitted extension?

    1. A.Three months from receipt
    2. B.Two months from receipt
    3. C.One month from receiptCorrect answer: C
    4. D.Six months from receipt

    Explanation: Article 12 requires information without undue delay and "in any event within one month of receipt of the request". An extension of two further months is possible when necessary, with timely notice and reasons.

    Reference: Regulation (EU) 2016/679, General Data Protection Regulation — Article 12(3)