PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free GDPR Foundation Practice Questions

Prepare for the PECB GDPR Foundation exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
Not published Pass Rate
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More PECB Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

PECB ISO/IEC 27001 Lead Implementer

Practice QuestionsStudy Guide

PECB ISO/IEC 27001 Lead Auditor

Practice QuestionsStudy Guide

PECB Certified ISO/IEC 27001 Foundation

Practice QuestionsStudy GuideFlashcards

PECB Certified ISO/IEC 42001 Lead Implementer (AI Management)

Practice QuestionsStudy GuideCheat SheetFlashcards

PECB ISO/IEC 42001 Lead Auditor (AI Management)

Practice Questions

PECB Certified ISO/IEC 27701 Lead Auditor (PIMS)

Practice Questions
2026 Statistics

Key Facts: GDPR Foundation Exam

40Q, 1 hour

Exam Format

PECB

70%

Passing Score

PECB

USD 500 exam-only

Exam Fee

PECB

PECB GDPR Foundation certification exam evaluates candidates on official PECB domains and standards. Note: this practice set is an English-language MCQ study adaptation.

Sample GDPR Foundation Practice Questions

Try these sample questions to test your GDPR Foundation exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1What does the abbreviation GDPR stand for?
A.Global Data Privacy Regulation
B.Governmental Data Protection Regime
C.General Data Processing Rules
D.General Data Protection Regulation
Explanation: GDPR stands for the General Data Protection Regulation, formally Regulation (EU) 2016/679 of the European Parliament and of the Council. It is the EU's core legal instrument for the protection of personal data of natural persons.
2The GDPR protects the personal data of which category of persons?
A.Deceased persons
B.Legal persons such as companies
C.Natural persons
D.Only EU citizens
Explanation: The GDPR protects natural persons, referred to as data subjects, in relation to the processing of their personal data. It does not protect data relating to legal persons (companies) or, as a rule, deceased persons, and it applies regardless of the data subject's nationality.
3Which of the following is an example of personal data under the GDPR?
A.A company's registered office address
B.An anonymised statistical dataset that cannot be linked to any individual
C.An employee's work email address containing their first and last name
D.The annual revenue figure published in a company's financial statements
Explanation: Personal data is any information relating to an identified or identifiable natural person. A work email address that contains an employee's name identifies that person directly, so it is personal data even in a professional context.
4From which date has the GDPR been directly applicable in all EU Member States?
A.27 April 2016
B.1 January 2017
C.25 May 2018
D.14 June 2021
Explanation: The GDPR became applicable on 25 May 2018, two years after its adoption. From that date it applies directly in all Member States without needing national transposition, because it is a regulation rather than a directive.
5Under the GDPR, a 'data subject' is best described as:
A.An identified or identifiable natural person to whom personal data relates
B.Any organisation that collects information about customers
C.A public authority that supervises data protection compliance
D.A person employed to manage an organisation's databases
Explanation: A data subject is the identified or identifiable natural person whose personal data is processed. A person is identifiable if they can be singled out directly or indirectly, for example by a name, identifier, location data, or online identifier.
6Which of the following activities would NOT normally be considered 'processing' of personal data under the GDPR?
A.Recording customer orders in a sales database
B.Deleting outdated employee records from an archive
C.Reading a printed newspaper article at home purely for personal interest
D.Analysing website visitor behaviour with tracking cookies
Explanation: Processing is any operation performed on personal data, including collection, recording, storage, use, disclosure, and erasure. Reading a newspaper for purely personal reasons does not involve processing personal data by an organisation and would fall under the household exemption even if it did.
7Which statement about pseudonymised data under the GDPR is correct?
A.Pseudonymised data is no longer personal data and falls outside the GDPR
B.Pseudonymised data may be freely transferred to any third country without safeguards
C.Pseudonymisation is prohibited because it weakens the security of personal data
D.Pseudonymised data remains personal data because it can still be attributed to a person using additional information
Explanation: Pseudonymisation replaces identifying attributes with artificial identifiers, but the data remains personal data because it can still be linked back to an individual with additional information kept separately. Only truly anonymised data falls outside the GDPR's scope.
8Which of the following is a 'special category' of personal data under Article 9 of the GDPR?
A.A person's job title
B.A person's purchase history of office supplies
C.A person's postal address
D.Data revealing a person's religious beliefs
Explanation: Article 9 lists special categories: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sex life or sexual orientation. Processing these is prohibited unless a specific exception applies.
9Under the GDPR, the 'controller' is the entity that:
A.Stores data on servers owned by a cloud provider
B.Determines the purposes and means of the processing of personal data
C.Processes personal data only on documented instructions from another entity
D.Is designated by law to monitor compliance with data protection rules
Explanation: Article 4(7) defines the controller as the natural or legal person that, alone or jointly with others, determines the purposes (why) and means (how) of the processing. The controller bears the primary responsibility for GDPR compliance.
10A payroll company calculates salaries for its clients strictly according to each client's instructions and contract. Under the GDPR, the payroll company acts as a:
A.Controller
B.Joint controller
C.Processor
D.Supervisory authority
Explanation: A processor processes personal data on behalf of the controller and according to its documented instructions. Because the payroll company does not decide why or how the employee data is used but merely executes the client's instructions, it acts as a processor.

About the GDPR Foundation Exam

The PECB GDPR Foundation certification evaluates professional competence in governance, implementation, auditing, and management according to PECB standards.

Questions

40 scored questions

Time Limit

1 hour

Passing Score

70%

Exam Fee

USD 500 exam-only (PECB (Professional Evaluation and Certification Board))

GDPR Foundation Exam Content Outline

~25%

Fundamental Concepts of Data Protection & GDPR

GDPR scope (material and territorial), definitions of personal data, special categories of data, data controller vs data processor roles.

~25%

Data Protection Principles & Lawful Basis

The six data protection principles (Article 5), legal bases for processing (Article 6), consent requirements, and legitimate interest assessments.

~25%

Data Subject Rights & Obligations

Right of access, rectification, erasure (right to be forgotten), data portability, restriction, objection, and automated decision-making.

~25%

Controller/Processor Governance & Technical Security

Data Protection Impact Assessments (DPIA), Privacy by Design & Default, breach notification (72h rule), DPO appointment, and international data transfers.

How to Pass the GDPR Foundation Exam

What You Need to Know

  • Passing score: 70%
  • Exam length: 40 questions
  • Time limit: 1 hour
  • Exam fee: USD 500 exam-only

Keys to Passing

  • Complete 500+ practice questions
  • Score 80%+ consistently before scheduling
  • Focus on highest-weighted sections
  • Use our AI tutor for tough concepts

GDPR Foundation Study Tips from Top Performers

1Review the official PECB candidate handbook
2Practice scenario-based questions across all domains
3Pace yourself to answer all questions within the time limit

Frequently Asked Questions

What is the format of the PECB GDPR Foundation exam?

The official exam consists of 40 questions over 1 hour. This practice set provides 100 English-language MCQs as a study aid.

Is this practice test free?

Yes, 100% free with detailed explanations.