CIPP/E LATEST COLLECTION OF EXAM QUESTIONS AND
VERIFIED ANSWERS WITH A 100% PASS GUARANTEE
1. What does GDPR stand for? General Data Protection Regulation
2. When did the GDPR come into effect? May 25, 2018
3. Which EU regulation does the GDPR replace? Data Protection Directive
95/46/EC
4. What is the territorial scope of GDPR Article 3(1)? It applies to
processing of personal data in the context of activities of an establishment of a
controller or processor in the EU, regardless of whether the processing takes
place in the EU
5. What is the territorial scope of GDPR Article 3(2)? It applies to
processing of personal data of data subjects in the EU by controllers/processors
not established in the EU when offering goods/services or monitoring behavior
6. What are the six lawful bases for processing under GDPR? Consent,
contract, legal obligation, vital interests, public task, legitimate interests
7. What is the definition of "personal data" under GDPR? Any information
relating to an identified or identifiable natural person
8. What makes a natural person "identifiable"? When they can be identified
directly or indirectly by reference to an identifier such as name, ID number,
location data, online identifier, or factors specific to their identity
9. What is "special category data"? Personal data revealing racial/ethnic
origin, political opinions, religious/philosophical beliefs, trade union
membership, genetic data, biometric data, health data, sex life, or sexual
orientation
10. What additional lawful basis is required for processing special category
data? One of the conditions listed in Article 9(2), such as explicit consent or
substantial public interest
11. What is the principle of "lawfulness, fairness and transparency"?
Personal data must be processed lawfully, fairly, and in a transparent manner in
relation to the data subject
,12. What is the principle of "purpose limitation"? Data must be collected for
specified, explicit, and legitimate purposes and not further processed in a
manner incompatible with those purposes
13. What is the principle of "data minimization"? Personal data must be
adequate, relevant, and limited to what is necessary for the purposes of
processing
14. What is the principle of "accuracy"? Personal data must be accurate and,
where necessary, kept up to date
15. What is the principle of "storage limitation"? Personal data must be kept
in a form that permits identification of data subjects for no longer than
necessary
16. What is the principle of "integrity and confidentiality"? Personal data
must be processed in a manner that ensures appropriate security, including
protection against unauthorized or unlawful processing and accidental loss,
destruction, or damage
17. What is the principle of "accountability"? The controller shall be
responsible for and be able to demonstrate compliance with the GDPR
principles
18. Who is a "data controller"? A natural or legal person, public authority,
agency, or other body which determines the purposes and means of processing
personal data
19. Who is a "data processor"? A natural or legal person, public authority,
agency, or other body which processes personal data on behalf of the controller
20. What is a "data subject"? An identified or identifiable natural person
21. What is "processing" under GDPR? Any operation performed on
personal data, such as collection, recording, organization, structuring, storage,
adaptation, retrieval, consultation, use, disclosure, dissemination, restriction,
erasure, or destruction
22. What are the requirements for valid consent under GDPR? It must be
freely given, specific, informed, and unambiguous through a clear affirmative
action
23. Can silence or pre-ticked boxes constitute valid consent? No, consent
requires a clear affirmative action
, 24. What is the difference between a controller and a processor? A
controller determines purposes and means of processing, while a processor
processes data on behalf of the controller
25. What must be included in a privacy notice under Articles 13 and 14?
Identity of controller, contact details of DPO, purposes and legal basis,
recipients, retention period, data subject rights, right to withdraw consent, right
to lodge complaint, and whether providing data is statutory/contractual
requirement
26. When must a privacy notice be provided under Article 13? At the time
when personal data are obtained from the data subject
27. When must a privacy notice be provided under Article 14? Within a
reasonable period after obtaining data (not more than one month), or at the time
of first communication, or at the time of first disclosure
28. What is the right of access under Article 15? Data subjects have the right
to obtain confirmation of whether their personal data is being processed and
access to that data
29. What is the right to rectification under Article 16? Data subjects have the
right to obtain rectification of inaccurate personal data and to have incomplete
data completed
30. What is the right to erasure ("right to be forgotten") under Article 17?
Data subjects have the right to obtain erasure of their personal data under
certain conditions
31. What are the grounds for erasure under Article 17? Data no longer
necessary, consent withdrawn, objection to processing, unlawful processing,
legal obligation to erase, data collected in relation to information society
services offered to children
32. What is the right to restriction of processing under Article 18? Data
subjects have the right to obtain restriction of processing under certain
conditions, such as when contesting accuracy
33. What is the right to data portability under Article 20? Data subjects
have the right to receive their personal data in a structured, commonly used,
machine-readable format and transmit it to another controller
34. When does the right to data portability apply? When processing is based
on consent or contract and is carried out by automated means
VERIFIED ANSWERS WITH A 100% PASS GUARANTEE
1. What does GDPR stand for? General Data Protection Regulation
2. When did the GDPR come into effect? May 25, 2018
3. Which EU regulation does the GDPR replace? Data Protection Directive
95/46/EC
4. What is the territorial scope of GDPR Article 3(1)? It applies to
processing of personal data in the context of activities of an establishment of a
controller or processor in the EU, regardless of whether the processing takes
place in the EU
5. What is the territorial scope of GDPR Article 3(2)? It applies to
processing of personal data of data subjects in the EU by controllers/processors
not established in the EU when offering goods/services or monitoring behavior
6. What are the six lawful bases for processing under GDPR? Consent,
contract, legal obligation, vital interests, public task, legitimate interests
7. What is the definition of "personal data" under GDPR? Any information
relating to an identified or identifiable natural person
8. What makes a natural person "identifiable"? When they can be identified
directly or indirectly by reference to an identifier such as name, ID number,
location data, online identifier, or factors specific to their identity
9. What is "special category data"? Personal data revealing racial/ethnic
origin, political opinions, religious/philosophical beliefs, trade union
membership, genetic data, biometric data, health data, sex life, or sexual
orientation
10. What additional lawful basis is required for processing special category
data? One of the conditions listed in Article 9(2), such as explicit consent or
substantial public interest
11. What is the principle of "lawfulness, fairness and transparency"?
Personal data must be processed lawfully, fairly, and in a transparent manner in
relation to the data subject
,12. What is the principle of "purpose limitation"? Data must be collected for
specified, explicit, and legitimate purposes and not further processed in a
manner incompatible with those purposes
13. What is the principle of "data minimization"? Personal data must be
adequate, relevant, and limited to what is necessary for the purposes of
processing
14. What is the principle of "accuracy"? Personal data must be accurate and,
where necessary, kept up to date
15. What is the principle of "storage limitation"? Personal data must be kept
in a form that permits identification of data subjects for no longer than
necessary
16. What is the principle of "integrity and confidentiality"? Personal data
must be processed in a manner that ensures appropriate security, including
protection against unauthorized or unlawful processing and accidental loss,
destruction, or damage
17. What is the principle of "accountability"? The controller shall be
responsible for and be able to demonstrate compliance with the GDPR
principles
18. Who is a "data controller"? A natural or legal person, public authority,
agency, or other body which determines the purposes and means of processing
personal data
19. Who is a "data processor"? A natural or legal person, public authority,
agency, or other body which processes personal data on behalf of the controller
20. What is a "data subject"? An identified or identifiable natural person
21. What is "processing" under GDPR? Any operation performed on
personal data, such as collection, recording, organization, structuring, storage,
adaptation, retrieval, consultation, use, disclosure, dissemination, restriction,
erasure, or destruction
22. What are the requirements for valid consent under GDPR? It must be
freely given, specific, informed, and unambiguous through a clear affirmative
action
23. Can silence or pre-ticked boxes constitute valid consent? No, consent
requires a clear affirmative action
, 24. What is the difference between a controller and a processor? A
controller determines purposes and means of processing, while a processor
processes data on behalf of the controller
25. What must be included in a privacy notice under Articles 13 and 14?
Identity of controller, contact details of DPO, purposes and legal basis,
recipients, retention period, data subject rights, right to withdraw consent, right
to lodge complaint, and whether providing data is statutory/contractual
requirement
26. When must a privacy notice be provided under Article 13? At the time
when personal data are obtained from the data subject
27. When must a privacy notice be provided under Article 14? Within a
reasonable period after obtaining data (not more than one month), or at the time
of first communication, or at the time of first disclosure
28. What is the right of access under Article 15? Data subjects have the right
to obtain confirmation of whether their personal data is being processed and
access to that data
29. What is the right to rectification under Article 16? Data subjects have the
right to obtain rectification of inaccurate personal data and to have incomplete
data completed
30. What is the right to erasure ("right to be forgotten") under Article 17?
Data subjects have the right to obtain erasure of their personal data under
certain conditions
31. What are the grounds for erasure under Article 17? Data no longer
necessary, consent withdrawn, objection to processing, unlawful processing,
legal obligation to erase, data collected in relation to information society
services offered to children
32. What is the right to restriction of processing under Article 18? Data
subjects have the right to obtain restriction of processing under certain
conditions, such as when contesting accuracy
33. What is the right to data portability under Article 20? Data subjects
have the right to receive their personal data in a structured, commonly used,
machine-readable format and transmit it to another controller
34. When does the right to data portability apply? When processing is based
on consent or contract and is carried out by automated means
