View Full IAPP CIPP-E Exam Dumps and Practice Test Dumps

 

Question 61: Which GDPR mechanism is designed to support cooperation between supervisory authorities when processing activities are cross-border in nature?

1. The one-stop-shop mechanism
2. The data portability mechanism
3. The storage limitation mechanism
4. The consent withdrawal mechanism

Correct Answer: 1. The one-stop-shop mechanism

Explanation: The GDPR’s one-stop-shop mechanism is intended to facilitate consistent supervision of cross-border processing activities. In qualifying circumstances, the supervisory authority of the controller’s or processor’s main establishment can act as the lead supervisory authority, working with other concerned authorities. This framework is supported by cooperation and consistency procedures involving the European Data Protection Board. The mechanism does not mean that only one authority can ever become involved. Concerned supervisory authorities may continue to exercise relevant powers in specified circumstances, particularly where local matters or urgent situations arise under the GDPR.

Question 62: What is generally meant by a controller’s “main establishment” under the GDPR?

1. The location where the organization has its largest number of employees
2. The location of the organization’s most profitable office
3. The place where the organization makes key decisions about the purposes and means of processing and has the power to implement those decisions
4. The country where the organization’s website receives the most visitors

Correct Answer: 3. The place where the organization makes key decisions about the purposes and means of processing and has the power to implement those decisions

Explanation: For determining the lead supervisory authority in relevant cross-border processing situations, the GDPR’s concept of main establishment focuses on where effective and real management activities occur concerning the determination of purposes and means of processing and where decisions can be implemented. It is not automatically the organization’s headquarters, largest office, or most profitable location. The assessment depends on the actual structure and decision-making arrangements for the processing concerned. If processing decisions are genuinely made across different establishments, organizations and supervisory authorities may need to examine the facts carefully to determine the appropriate establishment and regulatory authority.

Question 63: Which statement best describes the GDPR’s cooperation procedure among supervisory authorities?

1. Supervisory authorities are prohibited from exchanging information.
2. Supervisory authorities cooperate by sharing relevant information and taking measures to ensure consistent application of the GDPR.
3. Only the European Commission may investigate cross-border processing.
4. Cooperation is required only after a court judgment.

Correct Answer: 2. Supervisory authorities cooperate by sharing relevant information and taking measures to ensure consistent application of the GDPR.

Explanation: The GDPR establishes cooperation mechanisms allowing supervisory authorities to share information and provide mutual assistance in order to implement and apply the Regulation effectively and consistently. Cooperation can involve requests for information, investigative assistance, authorization and consultation procedures, and other coordinated activities. These mechanisms are especially important where processing affects individuals or organizations across multiple Member States. The European Data Protection Board also supports consistency through guidance and certain dispute-resolution mechanisms. Cooperation does not eliminate the independence of national supervisory authorities or prevent them from exercising their legally assigned powers.

Question 64: What is a “concerned supervisory authority” in the context of GDPR cross-border processing?

1. Any private organization that processes personal data
2. Only the supervisory authority of the controller’s country of incorporation
3. The European Commission whenever personal data crosses a border
4. A supervisory authority concerned by the processing because the controller or processor is established in its Member State, individuals there are substantially affected, or a complaint has been lodged there

Correct Answer: 4. A supervisory authority concerned by the processing because the controller or processor is established in its Member State, individuals there are substantially affected, or a complaint has been lodged there

Explanation: In cross-border processing, a concerned supervisory authority is a supervisory authority affected by the processing because the controller or processor is established in its Member State, data subjects in that Member State are substantially affected or likely to be substantially affected, or a complaint has been lodged with that authority. The concept allows authorities other than the lead supervisory authority to participate in the GDPR’s cooperation framework. Concerned authorities can raise relevant objections and contribute to consistent enforcement. This structure recognizes that cross-border processing can have significant effects in multiple Member States.

Question 65: Which body can adopt a binding decision when supervisory authorities disagree in certain cross-border cases under the GDPR consistency mechanism?

1. The European Data Protection Board
2. The European Parliament
3. The European Commission acting as a national supervisory authority
4. The Council of the European Union acting as a court

Correct Answer: 1. The European Data Protection Board

Explanation: Under the GDPR consistency mechanism, the European Data Protection Board can adopt legally binding decisions in certain disputes between supervisory authorities, including situations where an authority objects to a draft decision concerning cross-border processing. The EDPB’s role helps resolve disagreements and promote consistent application of the Regulation across Member States. The Board does not replace national supervisory authorities in ordinary enforcement matters. Instead, its binding dispute-resolution powers operate within the specific framework established by the GDPR. This mechanism is particularly relevant when national authorities cannot reach agreement through the ordinary cooperation process.

Question 66: Which of the following is generally an obligation of a processor under Article 28 of the GDPR?

1. Determining the purposes of all processing independently
2. Processing personal data only on documented instructions from the controller, unless otherwise required by EU or Member State law
3. Deciding which supervisory authority will investigate the controller
4. Selling personal data to third parties whenever commercially useful

Correct Answer: 2. Processing personal data only on documented instructions from the controller, unless otherwise required by EU or Member State law

Explanation: Article 28 requires a processor to process personal data only on documented instructions from the controller, including instructions concerning transfers, unless Union or Member State law requires otherwise. The processor must also implement appropriate security measures, assist the controller with certain GDPR obligations, maintain confidentiality, respect requirements concerning sub-processors, and support audits and compliance activities as required by the contractual arrangement and Regulation. A processor does not independently determine the purposes of the controller’s processing merely because it operates the technical systems. The actual facts of a relationship can nevertheless affect whether an entity qualifies as a processor or controller.

Question 67: What is generally required before a processor engages another processor to process personal data?

1. The processor must obtain the data subjects’ individual signatures.
2. The processor must transfer controller status to the sub-processor.
3. The processor must obtain the controller’s authorization in accordance with the GDPR requirements.
4. The processor may appoint any sub-processor without informing the controller.

Correct Answer: 3. The processor must obtain the controller’s authorization in accordance with the GDPR requirements.

Explanation: Article 28 regulates the use of sub-processors. A processor generally needs the controller’s prior specific or general written authorization before engaging another processor. Where general written authorization is provided, the processor must inform the controller of intended changes concerning the addition or replacement of sub-processors, giving the controller an opportunity to object. The sub-processor must be bound by data protection obligations that are materially equivalent to those imposed on the original processor under the controller-processor arrangement. The original processor remains responsible to the controller for the sub-processor’s compliance with those obligations.

Question 68: Which GDPR security principle requires security measures to be appropriate to the risks associated with processing?

1. Data minimization
2. Transparency
3. Accuracy
4. Risk-appropriate technical and organizational measures under Article 32

Correct Answer: 4. Risk-appropriate technical and organizational measures under Article 32

Explanation: Article 32 requires controllers and processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The Regulation identifies factors such as the state of the art, implementation costs, the nature, scope, context, and purposes of processing, and risks to individuals. Possible measures include pseudonymisation and encryption, confidentiality and resilience of systems, timely restoration of availability, and regular testing and evaluation of security measures. The GDPR therefore does not mandate one identical security technology for every organization. Security controls should be selected based on the risks and circumstances of the processing.

Question 69: Which of the following is an example of a technical measure that may contribute to GDPR security?

1. Encryption of personal data
2. Publishing employee passwords
3. Removing all internal access controls
4. Allowing unrestricted access to databases

Correct Answer: 1. Encryption of personal data

Explanation: Encryption is specifically identified in Article 32 as an example of a technical and organizational measure that may contribute to an appropriate level of security. Depending on the circumstances, encryption can reduce the risk of unauthorized access or disclosure by making information difficult to understand without the relevant cryptographic key. However, encryption is not automatically sufficient for every processing activity. Controllers and processors should consider other safeguards, such as access controls, authentication, resilience, incident response, backup and recovery, employee training, and regular security testing. The appropriate combination of controls should reflect the risks associated with the processing.

Question 70: Under the GDPR, which statement about privacy by design is most accurate?

1. Privacy safeguards should be considered only after a security incident occurs.
2. Privacy by design applies only to government organizations.
3. Controllers should implement appropriate technical and organizational measures designed to implement data protection principles effectively and integrate safeguards into processing.
4. Privacy by design eliminates the need for privacy notices.

Correct Answer: 3. Controllers should implement appropriate technical and organizational measures designed to implement data protection principles effectively and integrate safeguards into processing.

Explanation: Article 25 establishes data protection by design and by default. Controllers must implement appropriate technical and organizational measures designed to implement data protection principles effectively and integrate necessary safeguards into processing. The measures should reflect factors such as the state of the art, implementation costs, the nature and purposes of processing, and risks to individuals. Data protection should therefore be considered during the design and development of systems, products, services, and processes rather than added only after deployment. By default, organizations should process only the personal data necessary for each specific purpose.

Question 71: What does data protection by default generally require?

1. All available personal data must be collected by default.
2. The controller must make the maximum amount of data publicly available.
3. Privacy settings can be ignored if the service is convenient.
4. By default, only personal data necessary for each specific processing purpose should be processed.

Correct Answer: 4. By default, only personal data necessary for each specific processing purpose should be processed.

Explanation: Data protection by default means that appropriate measures should ensure that, by default, only personal data necessary for each specific purpose is processed. This includes considering the amount of data collected, the extent of processing, the period of storage, and accessibility. For example, a service should not automatically make optional personal information public or collect unnecessary data merely because the technical capability exists. The principle complements data minimization and privacy by design by embedding protective settings and practices into systems and business processes from the outset rather than relying entirely on individual users to configure privacy controls.

Question 72: Which statement about the GDPR’s administrative fines is correct?

1. Administrative fines are always fixed at the same amount regardless of the violation.
2. The GDPR provides different maximum fine levels depending on the relevant infringement, with certain violations subject to fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher.
3. Only private individuals can impose GDPR administrative fines.
4. The maximum GDPR fine is always €100,000.

Correct Answer: 2. The GDPR provides different maximum fine levels depending on the relevant infringement, with certain violations subject to fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher.

Explanation: Article 83 establishes administrative fine levels for GDPR infringements. Certain violations can attract fines of up to €20 million or, for an undertaking, up to 4% of its total worldwide annual turnover for the preceding financial year, whichever is higher. Other violations can be subject to a lower maximum of €10 million or 2% of worldwide annual turnover. The applicable amount depends on the nature of the infringement and the circumstances considered by the supervisory authority. Fines are not automatic at the maximum level; authorities must consider the factors identified in the GDPR when determining an appropriate sanction.

Question 73: Which factor may a supervisory authority consider when determining the amount of an administrative fine?

1. The organization’s preferred marketing strategy
2. The personal preferences of the organization’s customers
3. The nature, gravity and duration of the infringement, taking account of relevant circumstances
4. The color of the organization’s website

Correct Answer: 3. The nature, gravity and duration of the infringement, taking account of relevant circumstances

Explanation: Article 83 identifies factors that supervisory authorities should consider when determining whether to impose an administrative fine and its amount. These include the nature, gravity, and duration of the infringement; whether it was intentional or negligent; actions taken to mitigate damage; technical and organizational measures implemented; previous infringements; cooperation with the authority; categories of personal data affected; how the infringement became known; compliance with previous measures; and other relevant factors. The framework is designed to make sanctions effective, proportionate, and dissuasive. The maximum statutory fine is therefore not necessarily the amount imposed in an individual case.

Question 74: Which statement best describes the GDPR’s right to erasure?

1. Individuals can request deletion of personal data in certain circumstances, but the right is subject to specified exceptions.
2. Every deletion request must be granted immediately without assessment.
3. The right applies only when data was originally collected without consent.
4. The right requires organizations to delete all records concerning an individual, including information they are legally required to retain.

Correct Answer: 1. Individuals can request deletion of personal data in certain circumstances, but the right is subject to specified exceptions.

Explanation: Article 17 provides the right to erasure, sometimes called the right to be forgotten. Individuals may request erasure in circumstances such as when personal data is no longer necessary for its original purpose, consent is withdrawn where consent was the relevant basis and no other legal ground applies, or processing is unlawful. The right is not absolute. Exceptions can apply where processing is necessary for reasons such as exercising freedom of expression, complying with a legal obligation, public interest tasks, archiving or research in qualifying circumstances, or establishing, exercising, or defending legal claims. Controllers must therefore assess each request against the applicable requirements and exceptions.

Question 75: Which statement about the GDPR right to rectification is correct?

1. It allows individuals to request correction of inaccurate personal data and completion of incomplete data in certain circumstances.
2. It automatically requires deletion of all personal data.
3. It applies only to data processed for direct marketing.
4. It prevents organizations from retaining any historical records.

Correct Answer: 1. It allows individuals to request correction of inaccurate personal data and completion of incomplete data in certain circumstances.

Explanation: Article 16 provides the right to rectification. A data subject can request that inaccurate personal data concerning them be corrected without undue delay. Depending on the circumstances, the individual can also request completion of incomplete personal data, including by providing a supplementary statement. The right supports the GDPR’s accuracy principle and helps ensure that decisions and processing activities are based on reliable information. Rectification does not automatically require deletion of the underlying record or prevent lawful retention. Controllers should assess the requested correction, update relevant systems where appropriate, and comply with applicable notification obligations concerning recipients.

Question 76: Which GDPR provision addresses restrictions on processing personal data for certain archival, scientific, historical research, or statistical purposes?

1. Article 5 only
2. Article 89
3. Article 3 only
4. Article 28 only

Correct Answer: 2. Article 89

Explanation: Article 89 establishes safeguards and derogations relevant to processing for archiving purposes in the public interest, scientific or historical research purposes, and statistical purposes. Such processing must be subject to appropriate safeguards for the rights and freedoms of individuals, including technical and organizational measures where appropriate, particularly to ensure data minimization. The GDPR allows certain rights and obligations to be adapted through Union or Member State law when necessary and proportionate to achieve these purposes, subject to the conditions set out in the Regulation. Article 89 therefore supports research and archival activities while maintaining appropriate data protection safeguards.

Question 77: Which statement best describes the GDPR’s approach to children’s consent in relation to information society services?

1. The GDPR requires parental consent for every processing activity involving a child.
2. Children can never provide valid consent under the GDPR.
3. For certain information society services offered directly to a child, Article 8 establishes a specific age threshold of 16, with Member States able to lower it to not below 13.
4. The age threshold is always 18 in every EU Member State.

Correct Answer: 3. For certain information society services offered directly to a child, Article 8 establishes a specific age threshold of 16, with Member States able to lower it to not below 13.

Explanation: Article 8 contains specific rules for situations where consent is the lawful basis for processing personal data in relation to information society services offered directly to a child. Where the child is below 16, processing is lawful only if and to the extent that consent is given or authorized by the holder of parental responsibility, subject to Member State law allowing a lower age that cannot be below 13. Controllers must make reasonable efforts to verify that consent is given or authorized in accordance with the circumstances. These rules do not mean that every processing activity involving children requires parental consent.

Question 78: What is the GDPR’s general approach to privacy information provided to children?

1. Information addressed specifically to children should use clear and plain language that they can easily understand.
2. Children must receive no privacy information.
3. Privacy notices for children must always be written only in legal terminology.
4. The GDPR prohibits organizations from explaining processing to children.

Correct Answer: 1. Information addressed specifically to children should use clear and plain language that they can easily understand.

Explanation: The GDPR emphasizes transparency and recognizes that information directed at children requires particular clarity. Recital 58 states that where processing is addressed to a child, information and communication should be presented in clear and plain language that the child can easily understand. This reflects the broader transparency requirements under Article 12. Organizations should therefore consider the intended audience when designing privacy notices, consent interfaces, and other communications. The requirement does not mean that every privacy notice must be written for children, but where services or communications are specifically directed toward them, the presentation should be appropriate and understandable.

Question 79: Which GDPR principle is most directly connected to providing individuals with understandable information about processing activities?

1. Storage limitation
2. Transparency
3. Data minimization
4. Purpose limitation

Correct Answer: 2. Transparency

Explanation: Transparency is a fundamental aspect of the GDPR’s fairness and lawfulness requirements. Articles 12 to 14 require controllers to provide information to data subjects in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Individuals should be able to understand relevant aspects of how their personal data is processed, including purposes, legal bases, recipients, retention, and applicable rights. Transparency supports meaningful exercise of data-subject rights and allows individuals to make informed decisions about their interactions with organizations. It should be considered throughout the processing lifecycle rather than treated as merely a one-time privacy notice exercise.

Question 80: Which of the following best describes the principle of fairness under the GDPR?

1. Organizations may process personal data in any way that is technically possible.
2. Fairness requires organizations to avoid processing practices that unjustifiably disadvantage or mislead individuals and to process data in a manner consistent with reasonable expectations and applicable rights.
3. Fairness means that every individual must receive identical treatment regardless of circumstances.
4. Fairness applies only when processing is based on consent.

Correct Answer: 2. Fairness requires organizations to avoid processing practices that unjustifiably disadvantage or mislead individuals and to process data in a manner consistent with reasonable expectations and applicable rights.

Explanation: Fairness is part of the GDPR’s fundamental principle that personal data must be processed lawfully, fairly, and transparently. Fair processing involves considering the impact of processing on individuals, avoiding unjustified adverse effects, and ensuring that processing is consistent with applicable legal requirements and reasonable expectations. Fairness can be particularly relevant when organizations use personal data to make decisions, profile individuals, or introduce processing that individuals would not reasonably anticipate. The principle is not limited to consent-based processing. Controllers should assess whether their practices are balanced, understandable, and respectful of individuals’ rights and legitimate interests.