SC+ UK GDPR

What is the maximum length of time you can hold data for?

• As long as you might need the data at some point, you can hold it indefinitely

• 10 years is the maximum, but it's advised you delete it sooner

• There is no maximum - it should be kept as long as is necessary, then deleted

An organisation which handles data on the instructions of another individual or organisation is a...

• Data Controller

• Data Processor

• Data Subject

If somebody wants to take advantage of a price comparison service, which Individual Right might they exercise in order to have their data transferred?

• The Right to Restrict Processing

• The Right to data Portability

• The Right of Access

When a Data Controller passes data over to a Data Processor, they also hand over ALL responsibility for the safety and security of the data until it's given back

• True, Only the data processor is responsible for the safety and security of the data

• False, Both are responsible

What must data do to be considered PERSONAL DATA by the GDPR

• Include someone's full name

• Identify an individual

• Be harmful if lost or stolen

What does Data Minimisation mean?

• Compressing digital data files

• Writing people's data down in shorthand

• Only processing data which adequate, relevant and limited to what is necessary

An organisation which makes decisions about personal data is a...

• Data Controller

• Data Subject

• Data Processor

The GDPR forbids workers from taking personal data, or devices which can access personal data, outside of the workplace

• True

• False

What is Data Protection by Design?

• The requirement to create policies, procedures, systems, products and services with data security at their heart

• An illustrated diagram of the data flow throughout an organisation

• A method of keeping data safe in the art and design industry

A clothing store has an email subscription scheme which allows customers to provide their name and email address in order to receive news about new products and exclusive discounts. Unknown to their customers, the clothing store also sells this data to other organisations who use it to send direct marketing. This is a breach of which Principle of the GDPR?

• Accuracy

• Purpose Limitation

• Storage Limitation