The European Data Protection Board (EDPB) recommends measures to supplement transfer tools, in order to ensure compliance with the European Union (EU) level of personal data protection. According to these recommendations, what additional actions should be taken when a transfer to a third country is based upon an adequacy decision?

As a result of the European Court of Justice's ruling in the case of Google v. Spain, search engines outside the EEA are also likely to be subject to the Regulation's right to be forgotten. This holds true if the activities of an EU subsidiary and its U.S. parent are what?

Which of the following entities would most likely be exempt from complying with the GDPR?

In which scenario is a Controller most likely required to undertake a Data Protection Impact Assessment?

According to Article 84 of the GDPR, the rules on penalties applicable to infringements shall be laid down by?