PECB Certified Data Protection Officer GDPR Exam Questions

Page: 1 / 14
Total 80 questions

Want more questions? Get Premium Access.
()

Question 1

Scenario: 2

Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number). When the user clicks the email address box, a pop-up message appears as follows: ''Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: ''Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app. When customers want to make a purchase, they are also required to provide their bank account details. When the user finally creates the account, the following message appears: ''Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following Questio n:

Questio n:

Based on scenario 2, is John's request eligible under GDPR?

ANo, data subjects can request access to how their data is being collected but not details about its processing or storage.

BNo, data subjects are not eligible to request details on the collection, storage, or processing of their personal data.

CYes, data subjects have the right to request details on how their personal data is collected, stored, and processed.

DNo, because John's data was collected based on legitimate interest.

Answer : C

Under Article 15 of GDPR, the Right of Access allows data subjects to request detailed information about:

The purpose of data processing

Categories of personal data collected

Data recipients

Storage duration

Rights to rectification and erasure

John's request is valid under GDPR, making Option C correct. Option A is incorrect because GDPR grants full transparency. Option B is incorrect because data subjects must be informed upon request. Option D is incorrect because lawful basis does not override access rights.

GDPR Article 15 (Right of Access)

Recital 63 (Transparency in personal data processing)

Question 2

Which statement below regarding the difference between anonymization and pseudonymization is correct?

AAnonymization is reversible and the original data can be retrieved with the use of a public key encryption, while pseudonymization is not reversible and can be used only for non-identifiable data, such as gender, nationality, and occupation

BAnonymization is not reversible and the original data cannot be attributed to an individual, while pseudonymization is reversible and the original data can be attributed to an individual with the use of additional information

CAnonymization is the process of replacing a portion of the data with a common value to keep the identity of individuals anonymous, whereas pseudonymization is the process of adding mathematical noise to the data

Answer : B

According to GDPR Recital 26, anonymization permanently removes any possibility of re-identification, making it irreversible. Pseudonymization, as defined in Article 4(5), is reversible if the correct key or additional information is available. Pseudonymization still qualifies as personal data under GDPR, whereas anonymized data falls outside the scope of GDPR.

Question 3

Which of the statements below related to compliance monitoring is correct?

AThe DPO should monitor and measure all activities of the organization in order to ensure the suitability and effectiveness of the GDPR compliance program

BThe DPO should monitor internal compliance of the organization with applicable data protection laws

CThe DPO should assign roles and responsibilities to monitor GDPR compliance

Answer : B

GDPR Article 39(1)(b) states that the DPO is responsible for monitoring internal compliance with data protection laws, rather than assigning responsibilities or measuring all activities.

Question 4

Scenario 8: MA store is an online clothing retailer founded in 2010. They provide quality products at a reasonable cost. One thing that differentiates MA store from other online shopping sites is their excellent customer service.

MA store follows a customer-centered business approach. They have created a user-friendly website with well-organized content that is accessible to everyone. Through innovative ideas and services, MA store offers a seamless user experience for visitors while also attracting new customers. When visiting the website, customers can filter their search results by price, size, customer reviews, and other features. One of MA store's strategies for providing, personalizing, and improving its products is data analytics. MA store tracks and analyzes the user actions on its website so it can create customized experience for visitors.

In order to understand their target audience, MA store analyzes shopping preferences of its customers based on their purchase history. The purchase history includes the product that was bought, shipping updates, and payment details. Clients' personal data and other information related to MA store products included in the purchase history are stored in separate databases. Personal information, such as clients' address or payment details, are encrypted using a public key. When analyzing the shopping preferences of customers, employees access only the information about the product while the identity of customers is removed from the data set and replaced with a common value, ensuring that customer identities are protected and cannot be retrieved.

Last year, MA store announced that they suffered a personal data breach where personal data of clients were leaked. The personal data breach was caused by an SQL injection attack which targeted MA store's web application. The SQL injection was successful since no parameterized queries were used.

Based on this scenario, answer the following Questio n:

According to scenario 8, MA store analyzed shopping preferences of its customers by analyzing the product they have bought in the customer's purchase history. Which option is correct in this case?

AMA store can use this type of information for an indefinite period of time since it is anonymized

BMA store can use this type of information for a limited period of time since it is pseudonymized

CMA store can use this type of information only during the period for which data subjects have given consent

Answer : B

Since the data is pseudonymized (not fully anonymized), it remains personal data under GDPR and cannot be retained indefinitely. Article 5(1)(e) of GDPR states that personal data must be kept only for as long as necessary for the intended processing purpose. Additionally, Recital 26 of GDPR clarifies that pseudonymized data is still considered personal data if re-identification is possible. Therefore, MA Store must implement a retention policy that ensures the data is deleted or further anonymized once it is no longer needed for analysis.

Question 5

Scenario 4:

Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social medi

a. Berc requested that Berc's and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Questio n:

Questio n:

Based on scenario 4, Berc shared personal information of its clients with an international marketing company even though an adequacy decision was absent. Which of the following is a valid reason to do so?

AThe transfer of data does not depend on the adoption of an adequacy decision by the country where the company is located.

BAuthorization for data transfer from Berc's Chief Information Security Officer (CISO) is obtained.

CThe controller or processor provides appropriate safeguards for data protection.

DThe marketing company's reputation ensures compliance with data protection standards.

Answer : C

Under Article 46 of GDPR, in the absence of an adequacy decision, controllers can transfer data only if appropriate safeguards (e.g., Standard Contractual Clauses, Binding Corporate Rules) are in place.

Option C is correct because safeguards such as SCCs allow data transfers when no adequacy decision exists.

Option A is incorrect because adequacy decisions are a legal requirement, not optional.

Option B is incorrect because a CISO cannot authorize GDPR data transfers.

Option D is incorrect because reputation does not ensure GDPR compliance.

GDPR Article 46(1) (Appropriate safeguards for data transfers)

Recital 108 (Legally binding commitments for data protection)

Question 6

Questio n:

Under GDPR, the controller must demonstrate that data subjects have consented to the processing of their personal data, and the consent must be freely given.

What is the role of the DPO in ensuring compliance with this requirement?

AThe DPO should ensure that the controller has informed data subjects about their right to withdraw consent.

BThe DPO should ensure that the controller has implemented procedures to provide evidence that consent has been obtained for all relevant personal data.

CThe DPO should personally record information such as who consented, when they consented, and how consent was given.

DThe DPO should approve the legal basis for consent processing before the controller can collect personal data.

Answer : B

Under Article 7(1) of GDPR, controllers must be able to demonstrate that the data subject has given consent. The DPO advises on ensuring these procedures are in place but does not collect or approve consent directly.

Option B is correct because the DPO must verify that consent records exist and meet GDPR standards.

Option A is incorrect because informing data subjects about withdrawal rights is the controller's duty, not the DPO's.

Option C is incorrect because the DPO does not personally maintain consent logs.

Option D is incorrect because DPOs do not approve legal bases for processing---this is the controller's responsibility.

GDPR Article 7(1) (Controller must demonstrate valid consent)

GDPR Article 39(1)(b) (DPO ensures compliance with data protection obligations)

Question 7

Scenario 5:

Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Questio n:

Questio n:

Recpond stores files of candidates who are not selected in its databases, even if they withdraw consent. Is this acceptable under GDPR?

ANo, the GDPR requires the controller to erase personal data if the data subject withdraws their consent for data processing.

BYes, the GDPR only requires the controller to stop processing the data when consent is withdrawn but does not require its deletion.

CYes, the GDPR allows personal data to be processed even after consent is withdrawn so organizations can use the data for future recruitment opportunities.

DNo, Recpond must retain candidate data for statistical analysis but must anonymize it.

Answer : A

Under Article 17 of GDPR (Right to Erasure), data subjects have the right to request deletion of their personal data when consent is withdrawn, unless a legal obligation or legitimate interest requires retention.

Option A is correct because Recpond must erase personal data if consent is withdrawn and no other lawful basis exists.

Option B is incorrect because GDPR requires deletion, not just stopping processing.

Option C is incorrect because organizations cannot retain data for future purposes without an explicit legal basis.

Option D is incorrect because statistical use must involve anonymization, which is not mentioned in Recpond's process.

GDPR Article 17(1)(b) (Right to be forgotten when consent is withdrawn)

Recital 65 (Obligation to erase personal data when processing is no longer necessary)