ICDL Data Protection / GDPR (ICDL Foundation)

What is the primary definition of 'personal data' under the EU General Data Protection Regulation (GDPR)?

• AAny information relating to an identified or identifiable natural person.
• BOnly financial records and government-issued identification numbers.
• CAny data stored in an electronic database or digital file format.
• DInformation that specifically discloses a person's physical home address.

Which of the following is considered a 'special category' of personal data (sensitive personal data) under the GDPR?

• APersonal mobile phone numbers.
• BBiometric data used for uniquely identifying a natural person.
• CGeneral education history and degree certificates.
• DVehicle registration numbers.

A clinic uses biometric fingerprint scanners to authorize employee access to restricted medical supply rooms. Under the GDPR, how is this fingerprint data classified?

• AStandard personal data since it belongs to internal staff, not patients.
• BSpecial category personal data because it is biometric data used for unique identificatio…
• CPublic domain data because employees signed an employment contract.
• DNon-personal data because it is converted into a digital hash code.

Which of the following processes represents 'pseudonymization' rather than 'anonymization' under the GDPR?

• AReplacing patient names in a database with unique random IDs, while keeping a secure key…
• BAggregating website traffic statistics to show only the total number of monthly visitors.
• CPermanently deleting all identification records and identifiers from a customer service l…
• DDestroying the encryption key used to protect a database, rendering the data permanently…

Why is the distinction between anonymized data and pseudonymized data critical for organizations under the GDPR?

• AAnonymized data is subject to GDPR rules, whereas pseudonymized data is completely exempt.
• BPseudonymized data remains personal data and is subject to the GDPR, whereas truly anonym…
• COrganizations are fined automatically if they attempt to anonymize data without explicit…
• DPseudonymized data cannot legally be transferred outside of the European Economic Area un…

Which of the following scenarios describes 'processing' of personal data under the GDPR?

• AOnly the active editing or modification of personal customer records.
• BSimply viewing, storing, or hosting personal data on a cloud server without modifying it.
• COnly the public dissemination of personal data to third parties.
• DCreating anonymous statistics where individuals can never be re-identified.

Under the GDPR, what does the concept of 'material scope' determine?

• AThe physical geographic regions in which data protection regulations apply.
• BThe types of data processing activities to which the GDPR applies, such as wholly or part…
• CThe specific list of materials and server hardware allowed to store personal data.
• DThe financial status of the organization handling the personal data.

Which of the following data processing activities falls OUTSIDE the material scope of the GDPR?

• AProcessing of customer data by a small local bakery using a spreadsheet.
• BProcessing of personal data by a natural person in the course of a purely personal or hou…
• CProcessing of employee files by a non-profit voluntary organization.
• DProcessing of student data by a public university.

An online retail company based in Australia offers products specifically targeted at residents of France, pricing items in Euros and providing customer service in French. Does the GDPR apply to this company?

• ANo, because the company is headquartered outside of the European Union.
• BYes, because the company targets data subjects who are in the Union by offering goods and…
• CNo, because the company does not have a physical retail store inside the EU.
• DYes, but only if the company has more than 250 employees globally.

What is the historical basis for modern European data protection laws, including the GDPR?

• AThe Universal Copyright Convention.
• BThe European Convention on Human Rights (specifically Article 8, the right to respect for…
• CThe World Trade Organization Agreement on Trade-Related Aspects of Intellectual Property…
• DThe EU Digital Services Act established in the 1970s.

Under the GDPR, what does the principle of 'lawfulness, fairness and transparency' require of an organization?

• AData must be processed in a way that is clear, accessible, and in accordance with legal g…
• BAll processed personal data must be published openly on the Internet to ensure maximum tr…
• COrganizations must use open-source software for all database systems.
• DThe organization must obtain government authorization for every single processing activit…

Which GDPR principle is violated if an online retail company collects a user's location data and shoe size when the user is only signing up to download a free recipe PDF?

• AIntegrity and confidentiality.
• BData minimization.
• CAccuracy.
• DStorage limitation.

An insurance company collects customer contact information to process policy applications. Five years later, they decide to sell this contact list to a third-party marketing agency without informing the customers. Which GDPR principle does this violate?

• APurpose limitation.
• BAccuracy.
• CData minimization.
• DStorage limitation.

What does the principle of 'storage limitation' mean for an organization processing customer data?

• AOrganizations must buy high-capacity hard drives to store all data indefinitely.
• BPersonal data must be kept in a form which permits identification of data subjects for no…
• COrganizations must limit the number of cloud storage providers they use to exactly one.
• DThe amount of data stored per customer must not exceed 50 megabytes.

Which of the following actions is required to comply with the GDPR principle of 'accuracy'?

• ADeleting customer accounts if they fail to log in for more than six months.
• BTaking every reasonable step to ensure that personal data that are inaccurate, having reg…
• CEncrypting all database records with a 256-bit key.
• DPreventing users from modifying their own registered profile data.

Which principle of the GDPR requires data controllers to implement appropriate technical or organizational measures to protect data against unauthorized or unlawful processing, accidental loss, destruction, or damage?

• AData minimization.
• BIntegrity and confidentiality.
• CPurpose limitation.
• DStorage limitation.

Under the GDPR, what does the principle of 'accountability' require of a data controller?

• AThe controller must be responsible for, and be able to demonstrate compliance with, all t…
• BThe controller must employ a full-time professional accountant to audit data storage cost…
• CThe controller must publish all compliance documents on a public government registry.
• DThe controller must compensate data subjects financially for every cookie stored on their…

How many lawful bases for processing personal data are defined under Article 6 of the GDPR?

• AExactly six.
• BOnly two: consent and contract.
• CExactly twelve.
• DIt depends on the member state's national legislation.

A hotel collects credit card information from a guest to secure a room booking and charge for the stay. What is the most appropriate lawful basis for this processing under the GDPR?

• AConsent.
• BPerformance of a contract.
• CLegitimate interests.
• DVital interests.

A commercial bank is legally required by tax authorities to share transaction records of certain accounts to prevent tax evasion. What is the bank's lawful basis for this processing?

• APerformance of a contract.
• BCompliance with a legal obligation.
• CLegitimate interests.
• DProtection of vital interests.

An emergency room doctor accesses an unconscious patient's medical records to determine their blood type for a life-saving transfusion. What is the lawful basis for processing this data under the GDPR?

• APerformance of a contract.
• BProtection of vital interests.
• CConsent.
• DLegitimate interests.

When an organization relies on 'legitimate interests' (Article 6(1)(f)) as their lawful basis, what must they do before processing the personal data?

• AObtain written approval from the national Supervisory Authority.
• BPerform a balancing test to ensure the organization's interests are not overridden by the…
• CVerify that the data subject has signed a waiver releasing their GDPR rights.
• DPublish the complete legitimate interest assessment in a local newspaper.

To collect valid 'consent' under the GDPR, which of the following criteria must be met?

• AConsent must be freely given, specific, informed, and unambiguous, indicated by a clear a…
• BConsent must be written in a formal legal document signed in the presence of a notary pub…
• CConsent can be assumed if a user does not uncheck a pre-ticked box on a web form.
• DConsent must be obtained verbally and recorded via telephone calls.

A mobile game app prevents users from playing the game unless they consent to having their contact lists uploaded for targeted marketing. What makes this consent invalid under the GDPR?

• AIt is not freely given because access to the service is improperly conditional on consent…
• BIt is invalid because the consent was not obtained in writing using a pen.
• CIt is invalid because the app was downloaded from an app store based in the United States.
• DIt is invalid because the processing of contact lists is entirely banned under all circum…

Under the GDPR, what right does a data subject have regarding consent they have previously given for processing their personal data?

• AThey can only withdraw consent if they pay an administrative processing fee.
• BThey have the right to withdraw their consent at any time, and it must be as easy to with…
• CThey cannot withdraw consent once given, unless they close their customer account permane…
• DThey must provide a written justification to the supervisory authority to obtain permissi…

A municipal government authority processes resident addresses to organize public garbage collection services. What is the most appropriate lawful basis for this processing under the GDPR?

• ALegitimate interests of the government department.
• BPerformance of a task carried out in the public interest or in the exercise of official a…
• CConsent of each resident in the municipality.
• DCompliance with a commercial business contract.

When collecting personal data directly from a data subject, what information must a data controller provide under Article 13 of the GDPR?

• AThe contact details of the controller, the purposes of processing, the lawful basis, and…
• BA complete technical specification of the database security configurations.
• CThe names and home addresses of all employees who will view the data.
• DA copy of the organization's latest audited financial report.

A recruitment agency obtains a candidate's contact info and resume from a public job board rather than directly from the candidate. According to GDPR Article 14, within what timeframe must the agency provide the candidate with a privacy notice?

• AWithin a reasonable period after obtaining the personal data, but at the latest within on…
• BImmediately, within 24 hours of copying the data into their local systems.
• COnly after the candidate is successfully hired or placed in a job.
• DThere is no requirement to provide a notice if the data was found on a public network.

What is the primary purpose of a Data Subject Access Request (DSAR) under the GDPR?

• ATo allow individuals to permanently delete all records of their financial debts.
• BTo enable individuals to obtain confirmation as to whether their personal data is being p…
• CTo give individuals administrative access to the backend database of the company.
• DTo request that a company transfer all of its proprietary business software to the user.

Under the GDPR, what is the standard legal timeframe for a data controller to respond to a Data Subject Access Request (DSAR)?

• AWithout undue delay and at the latest within one month of receipt of the request.
• BExactly 72 hours from the moment the request is received.
• CWithin 90 calendar days, regardless of the complexity of the request.
• DAt the end of the organization's fiscal quarter.

Under what circumstance may a data controller charge a fee for responding to a Data Subject Access Request?

• AA standard handling fee can be charged for every request to cover mailing and printing co…
• BOnly if the request is manifestly unfounded or excessive, in which case a reasonable fee…
• CWhenever the request is submitted by an ex-employee rather than a current customer.
• DFees can be charged if the data subject has more than one active account with the organiz…

A customer discovers that a utility company has listed their birth year incorrectly in their customer profile. Under the GDPR, which right can the customer exercise to resolve this?

• ARight to data portability.
• BRight to rectification.
• CRight to object.
• DRight to restrict processing.

What is the common term used for the data subject's right to have their personal data erased by a controller under GDPR Article 17?

• AThe right to data portability.
• BThe right to be forgotten.
• CThe right to temporary restriction.
• DThe right to information audit.

A user demands that a bank erase all records of their outstanding car loan under the 'right to be forgotten'. Can the bank refuse this request?

• ANo, because the right to be forgotten is absolute and overrides all financial contracts.
• BYes, because processing is necessary for the performance of a contract or compliance with…
• CNo, but the bank can charge a fee equal to the remaining balance of the loan to execute t…
• DYes, but only if the bank obtains a court order from a judge within 30 days.

A customer contests the accuracy of their personal data held by an energy company. While the company is verifying the accuracy, what right can the customer exercise to stop the company from using the data?

• ARight to data portability.
• BRight to restriction of processing.
• CRight to object.
• DRight to be informed.

Under the GDPR, what does the 'right to data portability' allow a data subject to do?

• ACarry their paper files across international borders without customs checks.
• BReceive their personal data in a structured, commonly used, and machine-readable format,…
• CForce a company to delete all customer records of competitor organizations.
• DAccess the personal data of other users who share similar interests.

What are the specific legal conditions required to exercise the Right to Data Portability under Article 20 of the GDPR?

• AThe processing must be based on consent or a contract, and the processing must be carried…
• BThe data subject must have been a customer for at least twelve consecutive months.
• CThe data must be processed solely for compliance with a public legal obligation or public…
• DThe data must consist entirely of special categories of sensitive personal data.

An individual objects to receiving promotional emails from a retail store. Under Article 21 of the GDPR, what must the retailer do upon receiving this objection?

• AThe retailer must stop processing the data for direct marketing immediately, as this righ…
• BThe retailer can continue sending emails if they can demonstrate a compelling commercial…
• CThe retailer must charge a cancellation fee before removing the user from the marketing d…
• DThe retailer must forward the objection to the national police for criminal verification.

A researcher processes public health records under the lawful basis of 'public interest'. A citizen objects to their data being included. What must the controller do under GDPR Article 21?

• AThe controller must immediately delete the data, as all objections are absolute.
• BThe controller must stop processing the data unless they can demonstrate compelling legit…
• CThe controller can ignore the objection because public health research is completely exem…
• DThe controller must notify the supervisory authority and wait for a formal hearing.

Article 22 of the GDPR states that data subjects have the right not to be subject to a decision based solely on automated processing, including profiling. What qualifies a decision as falling under this article?

• AIt must produce legal effects concerning the data subject or similarly significantly affe…
• BIt must be reviewed by at least three different human employees.
• CIt must involve the transfer of data across international borders.
• DIt must be processed using artificial intelligence developed within the EU.

Under what circumstance is solely automated decision-making, which has significant effects on an individual, legally permitted under the GDPR?

• AIf it is necessary for entering into, or performance of, a contract between the data subj…
• BWhenever the data controller is a registered public limited company.
• CIf the automated decision-making tool has an accuracy rate of over 99%.
• DIf the processing takes place outside of business working hours.

What is the core requirement of the 'Data Protection by Design' principle under GDPR Article 25?

• AOrganizations must implement data protection safeguards and privacy-enhancing features at…
• BWebsites must be designed using specific blue and green colors to indicate privacy compli…
• CDatabases must be designed by certified software architects who reside in the EU.
• DEvery new software project must use blockchain technology to store transaction logs.

Which of the following scenarios best demonstrates compliance with the principle of 'Data Protection by Default'?

• AA social media application sets user profiles to 'Private' automatically upon registratio…
• BAn app requests access to a user's microphone, camera, and contacts immediately upon firs…
• CA newsletter registration page pre-ticks the checkbox to sign the user up for third-party…
• DA service stores all customer passwords in plain text for easier retrieval during passwor…

Under what circumstance is a Data Protection Impact Assessment (DPIA) mandatory under the GDPR?

• AWhenever an organization processes any personal data, regardless of risk or volume.
• BWhen a type of processing—particularly using new technologies—is likely to result in a hi…
• COnly when a data breach has already occurred and been reported to the public.
• DWhen the organization changes its legal headquarters to a different country.

According to GDPR Article 35, which of the following is a required component of a Data Protection Impact Assessment (DPIA)?

• AA systematic description of the envisaged processing operations, an assessment of the nec…
• BA complete list of the names, salaries, and background checks of all IT administrators.
• CA copy of the sales projection reports for the new software service.
• DThe physical IP addresses of all data subjects who will be processed.

What must a data controller do if a Data Protection Impact Assessment (DPIA) indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk?

• AProceed with the processing, but increase the security budget by 10%.
• BConsult the Supervisory Authority prior to processing.
• CImmediately abandon the project and delete all collected code.
• DPublish the DPIA on the dark web to inform security researchers.

Under the GDPR, what is the core distinction between a 'Data Controller' and a 'Data Processor'?

• AThe controller determines the purposes and means of processing personal data, while the p…
• BThe controller is always a public authority, whereas the processor is always a private co…
• CThe controller stores data physically, while the processor only handles cloud storage.
• DThe controller is legally responsible for GDPR compliance, whereas the processor has no l…