PECB Certified Data Protection Officer GDPR Exam Questions

Page: 1 / 14
Total 80 questions

Want more questions? Get Premium Access.
()

Question 1

Scenario 5:

Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Questio n:

Questio n:

Based on scenario 5, the DPO reports directly to Recpond's top management. Is this in alignment with GDPR requirements?

AYes, Article 38 of the GDPR requires that the DPO reports directly to the highest management level of the controller.

BNo, Article 38 of the GDPR requires that the DPO reports directly to the supervisory authority to ensure independence in performing their tasks.

CYes, based on GDPR, the controller may choose any reporting structure for the DPO, including top and middle management.

DNo, DPOs should report directly to department heads, not top management.

Answer : A

Under Article 38(3) of GDPR, the DPO must report directly to the highest level of management to ensure independence and avoid interference in their tasks.

Option A is correct because GDPR requires direct reporting to top management.

Option B is incorrect because the DPO does not report to the supervisory authority, but they can liaise with it.

Option C is incorrect because GDPR does not allow reporting to middle management.

Option D is incorrect because department heads cannot oversee the DPO's work, ensuring they remain free from conflict of interest.

GDPR Article 38(3) (DPO must report to highest management)

Recital 97 (DPO's independence and protection from undue influence)

Question 2

Scenario 9: Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.

As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers' dat

a. Data collected by Soin includes customer's ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin's data processing activities are built based on customer's consent.

At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin. However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin's data processing activities. The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices. The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin's clients claiming that they do not have access in their personal data stored by Soin. Soin's Customer Service Department answered the emails saying that, based on Soin's policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.

All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions. Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.

Based on this scenario, answer the following Questio n:

To whom should the DPO of Soin report the situations observed during the data protection internal audit?

ASoin's top management

BSupervisory authority

CSoin's internal auditor

Answer : A

Under GDPR Article 38(3), the DPO must report directly to the highest level of management. The DPO provides guidance and recommendations but does not report directly to the supervisory authority unless required under Article 58 (e.g., in case of noncompliance or high-risk processing activities). Internal auditors may be involved, but the primary responsibility for GDPR compliance lies with top management.

Question 3

Scenario 8: MA store is an online clothing retailer founded in 2010. They provide quality products at a reasonable cost. One thing that differentiates MA store from other online shopping sites is their excellent customer service.

MA store follows a customer-centered business approach. They have created a user-friendly website with well-organized content that is accessible to everyone. Through innovative ideas and services, MA store offers a seamless user experience for visitors while also attracting new customers. When visiting the website, customers can filter their search results by price, size, customer reviews, and other features. One of MA store's strategies for providing, personalizing, and improving its products is data analytics. MA store tracks and analyzes the user actions on its website so it can create customized experience for visitors.

In order to understand their target audience, MA store analyzes shopping preferences of its customers based on their purchase history. The purchase history includes the product that was bought, shipping updates, and payment details. Clients' personal data and other information related to MA store products included in the purchase history are stored in separate databases. Personal information, such as clients' address or payment details, are encrypted using a public key. When analyzing the shopping preferences of customers, employees access only the information about the product while the identity of customers is removed from the data set and replaced with a common value, ensuring that customer identities are protected and cannot be retrieved.

Last year, MA store announced that they suffered a personal data breach where personal data of clients were leaked. The personal data breach was caused by an SQL injection attack which targeted MA store's web application. The SQL injection was successful since no parameterized queries were used.

Based on this scenario, answer the following Questio n:

According to scenario 8, by storing clients' information in separate databases, MA store used a:

AData protection by design strategy

BData protection by default technology

CPseudonymization method

Answer : A

Separating databases for different types of data aligns with the principle of Data Protection by Design and by Default under Article 25 of GDPR. By structuring data storage in a way that limits access and minimizes exposure, MA Store is proactively implementing security measures that prevent unauthorized access and mitigate risks in case of a breach. This approach supports the confidentiality, integrity, and availability of personal data as required by GDPR.

Question 4

Bus Spot is one of the largest bus operators in Spain. The company operates in local transport and bus rental since 2009. The success of Bus Spot can be attributed to the digitization of the bus ticketing system, through which clients can easily book tickets and stay up to date on any changes to their arrival or departure time. In recent years, due to the large number of passengers transported daily. Bus Spot has dealt with different incidents including vandalism, assaults on staff, and fraudulent injury claims. Considering the severity of these incidents, the need for having strong security measures had become crucial. Last month, the company decided to install a CCTV system across its network of buses. This security measure was taken to monitor the behavior of the company's employees and passengers, enabling crime prevention and ensuring safety and security. Following this decision, Bus Spot initiated a data protection impact assessment (DPIA). The outcome of each step of the DPIA was documented as follows: Step 1: In all 150 buses, two CCTV cameras will be installed. Only individuals authorized by Bus Spot will have access to the information generated by the CCTV system. CCTV cameras capture images only when the Bus Spot's buses are being used. The CCTV cameras will record images and sound. The information is transmitted to a video recorder and stored for 20 days. In case of incidents, CCTV recordings may be stored for more than 40 days and disclosed to a law enforcement body. Data collected through the CCTV system will be processed bv another organization. The purpose of processing this tvoe of information is to increase the security and safety of individuals and prevent criminal activity. Step 2: All employees of Bus Spot were informed for the installation of a CCTV system. As the data controller, Bus Spot will have the ultimate responsibility to conduct the DPI

AAppointing a DPO at that point was deemed unnecessary. However, the data processor's suggestions regarding the CCTV installation were taken into account. Step 3: Risk Likelihood (Unlikely, Possible, Likely) Severity (Moderate, Severe, Critical) Overall risk (Low, Medium, High) There is a risk that the principle of lawfulness, fairness, and transparency will be compromised since individuals might not be aware of the CCTV location and its field of view. Likely Moderate Low There is a risk that the principle of integrity and confidentiality may be compromised in case the CCTV system is not monitored and controlled with adequate security measures. Possible Severe Medium There is a risk related to the right of individuals to be informed regarding the installation of CCTV cameras. Possible Moderate Low Step 4: Bus Spot will provide appropriate training to individuals that have access to the information generated by the CCTV system. In addition, it will ensure that the employees of the data processor are trained as well. In each entrance of the bus, a sign for the use of CCTV will be displayed. The sign will be visible and readable by all passengers. It will show other details such as the purpose of its use, the identity of Bus Spot, and its contact number in case there are any queries. Only two employees of Bus Spot will be authorized to access the CCTV system. They will continuously monitor it and report any unusual behavior of bus drivers or passengers to Bus Spot. The requests of individuals that are subject to a criminal activity for accessing the CCTV images will be evaluated only for a limited period of time. If the access is allowed, the CCTV images will be exported by the CCTV system to an appropriate file format. Bus Spot will use a file encryption software to encrypt data before transferring onto another file format. Step 5: Bus Spot's top management has evaluated the DPIA results for the processing of data through CCTV system. The actions suggested to address the identified risks have been approved and will be implemented based on best practices. This DPIA involves the analysis of the risks and impacts in only a group of buses located in the capital of Spain. Therefore, the DPIA will be reconducted for each of Bus Spot's buses in Spain before installing the CCTV system. Based on this scenario, answer the following Questio n:
Questio n:
According to scenario 6, which data protection solution has Bus Spot used to reduce the risk related to the principle of lawfulness, fairness, and transparency?

ARisk reduction

BRisk retention

CRisk transfer

DRisk avoidance

Answer : A, A

Under Article 5(1)(a) of GDPR, personal data must be processed lawfully, fairly, and transparently. Bus Spot implemented measures such as employee training and signage in buses, which reduced risks associated with transparency.

Option A is correct because Bus Spot took steps to reduce risk, such as clear notification signs and restricted CCTV access.

Option B is incorrect because risk retention means accepting the risk without mitigation, which Bus Spot did not do.

Option C is incorrect because risk transfer applies to outsourcing responsibilities (e.g., insurance), which is not the case here.

Option D is incorrect because Bus Spot did not avoid risk entirely; they implemented controls to mitigate it.

GDPR Article 5(1)(a) (Principle of lawfulness, fairness, and transparency)

Recital 39 (Transparency in data processing)

Question 5

Questio n:

Under GDPR, the controller must demonstrate that data subjects have consented to the processing of their personal data, and the consent must be freely given.

What is the role of the DPO in ensuring compliance with this requirement?

AThe DPO should ensure that the controller has informed data subjects about their right to withdraw consent.

BThe DPO should ensure that the controller has implemented procedures to provide evidence that consent has been obtained for all relevant personal data.

CThe DPO should personally record information such as who consented, when they consented, and how consent was given.

DThe DPO should approve the legal basis for consent processing before the controller can collect personal data.

Answer : B

Under Article 7(1) of GDPR, controllers must be able to demonstrate that the data subject has given consent. The DPO advises on ensuring these procedures are in place but does not collect or approve consent directly.

Option B is correct because the DPO must verify that consent records exist and meet GDPR standards.

Option A is incorrect because informing data subjects about withdrawal rights is the controller's duty, not the DPO's.

Option C is incorrect because the DPO does not personally maintain consent logs.

Option D is incorrect because DPOs do not approve legal bases for processing---this is the controller's responsibility.

GDPR Article 7(1) (Controller must demonstrate valid consent)

GDPR Article 39(1)(b) (DPO ensures compliance with data protection obligations)

Question 6

Questio n:

Which of the following scenarios does NOT require conducting a DPIA?

AWhen an organization processes data to comply with legal obligations under applicable Union law.

BWhen a hospital collects and processes genetic and health data of its patients.

CWhen an organization collects public social media profiles for ad personalization.

DWhen an organization installs AI-driven video analytics to track employees' work patterns.

Answer : A

Under Article 35(1) of GDPR, a DPIA is not required when processing is based on a legal obligation under EU or national law.

Option A is correct because legal obligations provide a lawful basis for processing, making DPIAs unnecessary unless explicitly required by law.

Option B is incorrect because health and genetic data are special categories of data, requiring a DPIA under Article 35(3)(b).

Option C is incorrect because profiling and behavioral analysis require a DPIA, as per Article 35(3)(a).

Option D is incorrect because workplace surveillance with AI requires a DPIA, as it involves automated monitoring.

GDPR Article 35(1) (DPIA requirement for high-risk processing)

Recital 91 (Health data and large-scale profiling require DPIAs)

Question 7

Scenario 3:

COR Bank is an international banking group that operates in 31 countries. It was formed as the merger of two well-known investment banks in Germany. Their two main fields of business are retail and investment banking. COR Bank provides innovative solutions for services such as payments, cash management, savings, protection insurance, and real-estate services. COR Bank has a large number of clients and transactions. Therefore, they process large information, including clients' personal dat

a. Some of the data from the application processes of COR Bank, including archived data, is operated by Tibko, an IT services company located in Canada. To ensure compliance with the GDPR, COR Bank and Tibko have reached a data processing agreement Based on the agreement, the purpose and conditions of data processing are determined by COR Bank. However, Tibko is allowed to make technical decisions for storing the data based on its own expertise. COR Bank aims to remain a trustworthy bank and a long-term partner for its clients. Therefore, they devote special attention to legal compliance. They started the implementation process of a GDPR compliance program in 2018. The first step was to analyze the existing resources and procedures. Lisa was appointed as the data protection officer (DPO). Being the information security manager of COR Bank for many years, Lisa had knowledge of the organization's core activities. She was previously involved in most of the processes related to information systems management and data protection. Lisa played a key role in achieving compliance to the GDPR by advising the company regarding data protection obligations and creating a data protection strategy. After obtaining evidence of the existing data protection policy, Lisa proposed to adapt the policy to specific requirements of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of departments. As the DPO, she had access to several departments, including HR and Accounting Department. This assured the organization that there was a continuous cooperation between them. The activities of some departments within COR Bank are closely related to data protection. Therefore, considering their expertise, Lisa was advised from the top management to take orders from the heads of those departments when taking decisions related to their field. Based on this scenario, answer the following Questio n:

Questio n:

According to scenario 3, Tibko stores archived data on behalf of COR Bank. This means that Tibko is a:

AData controller, since they control some of the data from the application processes of COR Bank.

BData processor, since they store COR Bank's data based on the purpose and conditions defined by COR Bank.

CJoint controller with COR Bank, since they archive COR Bank's data and take technical decisions regarding data protection.

DIndependent controller, since Tibko handles data security and storage.

Answer : B

Under Article 4(8) of GDPR, a data processor processes personal data on behalf of a controller and does not determine the purpose of processing. Tibko only stores and manages data but does not decide why it is processed.

Option B is correct because Tibko acts as a processor for COR Bank.

Option A is incorrect because Tibko does not determine data processing purposes.

Option C is incorrect because joint controllers must jointly decide on processing purposes.

Option D is incorrect because Tibko does not act as an independent controller.

GDPR Article 4(8) (Definition of a processor)

GDPR Article 28 (Processor obligations)