A.The requirements affected individuals without exception.

B.The requirements were financially burdensome to EU businesses.

C.The requirements specified that data must be held within the EU.

D.The requirements had limitations on how national authorities could use data.

A.Within 40 days of receipt

B.Within 40 days of receipt, which may be extended by up to 40 additional days

C.Within one month of receipt, which may be extended by up to an additional month

D.Within one month of receipt, which may be extended by an additional two months

A.Their decision to operate without a data protection officer.

B.Their engagement of Company C to improve their payroll service.

C.Their failure to provide sufficient security safeguards to Company A's data.

D.This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.
Under the GDPR, which of Company B's actions would NOT be likely to trigger a potential enforcement action?

E.She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company

F.Their omission of data protection provisions in their contract with Company C.

A.The Article 29 Working Party.

B.The European Data Protection Board.

C.The European Commission.

D.The Council of the European Union.

A.Adequacy determinations automatically lapse when a Member State leaves the EU.

B.The UK is less trustworthy now that its not part of the Union.

C.The Insurance Commissioner determined that an adequacy determination is required by the Data Protection Act.

D.The UK is now a third country because it's no longer subject to the GDPR.