Test Questions

Question 1

When does an organization need to take action to legitimize cross-border transfers?

Answer 1

when data transferred from a jurisdiction in the EU to a 3rd country not adequate

Question 2

What is the time period within which a controller needs to respond to a data subject request?

Answer 2

without undue delay or within one month of receiving request

Question 3

As a regulation, are GDPR’s provisions binding?

Answer 3

Yes.

on EU member states but leaves discretion in some areas

Question 4

When processing an individual’s personal data in the context of direct marketing activities, what must data controllers do?

Answer 4

provide individuals with information explaining that their personal data will be used for marketing purposes

Question 5

Can you require consent?

Answer 5

No.

consent must be freely given - given on a voluntary basis. there must be a real choice. any element of inappropriate pressure or influence renders the consent invalid.

Question 6

What information should be provided in an employer notice about monitoring?

Answer 6

purpose of monitoring
potential uses of the data
employee rights related to their data
whom employees should contact

Question 7

What must a controller do upon receiving a proper request for erasure and that data has been made public?

Answer 7

take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Question 8

What was a major goal of the OECD Guidelines, Convention 108 and Data Protection Directive?

Answer 8

synchronization of approaches to data protection

(harmonized approach)

Question 9

What are the 7 Privacy Shield principles?

Answer 9

1. Notice
2. Access
3. Choice
4. Accountability for onward transfer
5. Security
6. Data integrity and purpose limitation
7. Recourse, enforcement and liability

Question 10

How is pseudyonmous data defined in GDPR?

Answer 10

Data that cannot be attributed to a specific data subject without the use of additional
information kept separately.

Question 11

When does the right not to be subject to automated decision-making NOT apply?

Answer 11

1. decision is necessary for entering into or performance of a contract
2. authorized by Union or Member State law, and tehre are suitable safeguards
3. based on data subject’s explicit consent

Question 12

Can a data subject lodge a complaint with SA without first registering complaint with controller?

Answer 12

Yes.