Online Access Free PDP9 Practice Test

Which of the following would NOT be a personal data breach'?

• A.The unauthorised changing of a persons address details on a database of customers.
• B.The accidental destruction of a current employee's HR file.
• C.The accidental deletion of an organisation's information security policy from the public facing website
• D.The loss of a memory stick containing the names and addresses of students in private accommodation

What is the basis of the accountability and data governance obligation (Article 5 (2) of the GDPR)?

• A.Controllers and Processors each have a responsibility to conduct legitimate interests balancing tests before processing data for direct marketing
• B.The controller shall appoint a DPO before carrying out large scale processing
• C.The controller shall be responsible for. and be able to demonstrate compliance with the data protection principles.
• D.Processors have overarching responsibility to ensure their processing is compliant

Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?

• A.It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
• B.It is key to the accountability element of the GDPR.
• C.It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated
• D.It fulfils a requirement that data protection is carried out by design and default.

Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?

• A.It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
• B.It is key to the accountability element of the GDPR.
• C.It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated
• D.It fulfils a requirement that data protection is carried out by design and default.

An individual applies for a job as a security guard The employer has had significant issues with the sickness record of past recruits They therefore decide to offer the position to the individual on the basis they request a copy of their medical record so that the employer can be assured that they are in a good state of health.
The Data Protection Officer has been asked to advise. What advice is MOST appropriate?

• A.In requesting information that is more than they necessary require to verify the medical condition of the individual they will have breached the data minimisation principle
• B.Providing the medical evidence is used for a legitimate purpose, and that the information is securely destroyed on verification that the employee is healthy, this is an acceptable action.
• C.While requesting and viewing medical evidence may be legitimate, they should ask for evidence that the individual consents to the proposition that they make the request
• D.This is a criminal offence under the Data Protection Act 2018 No individual should be asked to make a subject access request in order to obtain health records in these circumstances.