Trusted Worldwide Questions & Answers
Most Recent PECB GDPR Exam Dumps
Prepare for the PECB Certified Data Protection Officer exam with our extensive collection of questions and answers. These practice Q&A are updated according to the latest syllabus, providing you with the tools needed to review and test your knowledge.
QA4Exam focus on the latest syllabus and exam objectives, our practice Q&A are designed to help you identify key topics and solidify your understanding. By focusing on the core curriculum, These Questions & Answers helps you cover all the essential topics, ensuring you're well-prepared for every section of the exam. Each question comes with a detailed explanation, offering valuable insights and helping you to learn from your mistakes. Whether you're looking to assess your progress or dive deeper into complex topics, our updated Q&A will provide the support you need to confidently approach the PECB GDPR exam and achieve success.
The questions for GDPR were last updated on Apr 3, 2025.
- Viewing page 1 out of 16 pages.
- Viewing questions 1-5 out of 80 questions
Scenario:
BookSt is an online bookshop that collects personal data before selling its products. Sarah signed up for an account, providing her name, email, and password. To purchase a book, Sarah was required to provide her shipping address and payment information, which is needed to calculate shipping costs and complete the transaction.
Questio n:
Does the company have a legal basis for processing Sarah's data?
GDPR Article 6(1)(b) (Processing necessary for contract performance)
Recital 44 (Contractual necessity as a legal basis)
Scenario 1:
MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs.
Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic dat
a. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed.
Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients' requests to stop data processing are rejected. This decision was made by MED's top management to retain the information of everyone registered in their databases.
The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
MED believes that it is its responsibility to ensure the security and accuracy of patients' personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.
Questio n:
Based on scenario 1, MED shares patients' personal data with a health insurance company. Does MED comply with the purpose limitation principle?
Under Article 5(1)(b) of GDPR, personal data must be collected for specific, explicit, and legitimate purposes and cannot be further processed in a manner incompatible with those purposes. Sharing medical data with an insurance company is a separate purpose and requires explicit consent or another lawful basis.
GDPR Article 5(1)(b) (Purpose limitation)
Scenario 8: MA store is an online clothing retailer founded in 2010. They provide quality products at a reasonable cost. One thing that differentiates MA store from other online shopping sites is their excellent customer service.
MA store follows a customer-centered business approach. They have created a user-friendly website with well-organized content that is accessible to everyone. Through innovative ideas and services, MA store offers a seamless user experience for visitors while also attracting new customers. When visiting the website, customers can filter their search results by price, size, customer reviews, and other features. One of MA store's strategies for providing, personalizing, and improving its products is data analytics. MA store tracks and analyzes the user actions on its website so it can create customized experience for visitors.
In order to understand their target audience, MA store analyzes shopping preferences of its customers based on their purchase history. The purchase history includes the product that was bought, shipping updates, and payment details. Clients' personal data and other information related to MA store products included in the purchase history are stored in separate databases. Personal information, such as clients' address or payment details, are encrypted using a public key. When analyzing the shopping preferences of customers, employees access only the information about the product while the identity of customers is removed from the data set and replaced with a common value, ensuring that customer identities are protected and cannot be retrieved.
Last year, MA store announced that they suffered a personal data breach where personal data of clients were leaked. The personal data breach was caused by an SQL injection attack which targeted MA store's web application. The SQL injection was successful since no parameterized queries were used.
Based on this scenario, answer the following Questio n:
According to scenario 8, by storing clients' information in separate databases, MA store used a:
Separating databases for different types of data aligns with the principle of Data Protection by Design and by Default under Article 25 of GDPR. By structuring data storage in a way that limits access and minimizes exposure, MA Store is proactively implementing security measures that prevent unauthorized access and mitigate risks in case of a breach. This approach supports the confidentiality, integrity, and availability of personal data as required by GDPR.
Scenario 5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Questio n:
Questio n:
Which statement regarding the material scope of the GDPR is incorrect?
The material scope of the GDPR is outlined in Article 2. It applies to the processing of personal data by automated means and to non-automated processing if the data is part of a filing system. The GDPR does not apply to activities outside the scope of Union law, such as national security activities, which are excluded under Recital 16.
Option B is correct because the GDPR does not apply to activities falling outside the scope of Union law, such as law enforcement operations covered by the Law Enforcement Directive (EU 2016/680).
Option A is incorrect because automated processing is explicitly covered by GDPR.
Option C is incorrect because data processing by Member States under TEU (e.g., national security and defense) is excluded.
Option D is incorrect because GDPR applies to controllers/processors established in the EEA, even if data subjects are outside the EEA (Article 3(1)).
GDPR Article 2(2)(a) (Exclusion of activities outside EU law)
GDPR Article 3(1) (Territorial scope)
Recital 16 (GDPR does not apply to national security)
Scenario:
ChatBubble is a software company that stores personal data, including usernames, emails, and passwords. Last month, an attacker gained access to ChatBubble's system, but the personal data was encrypted, preventing unauthorized access.
Questio n:
Should the data subjects be notified in this case?
Under Article 34(3)(a) of GDPR, if personal data is encrypted or otherwise protected, notification to data subjects is not required unless the risk is high.
Option C is correct because encryption renders the data unintelligible to unauthorized parties, reducing risk.
Option A is incorrect because not all breaches require data subject notification---only those posing high risks.
Option B is incorrect because the number of affected individuals does not determine notification requirements.
Option D is incorrect because notification is based on risk assessment, not supervisory authority requests alone.
GDPR Article 34(3)(a) (No notification required if encryption makes data inaccessible)
Recital 86 (Notification is necessary only if data loss poses a significant risk)
Unlock All Questions for PECB GDPR Exam
Full Exam Access, Actual Exam Questions, Validated Answers, Anytime Anywhere, No Download Limits, No Practice Limits
Get All 80 Questions & Answers