Socialization & Awareness PDP Law

What is the difference between data controller and data processor?

• Data controllers sets forth the purpose of data processing and oversees data processing activities, while data processor act upon the data on behalf of data controller

• Data processors sets forth the purpose of data

  processing and oversees

  data processing activities,

  while data controllers act

  upon the data on behalf of another

• There are no differences, data controller and processors are interchangeable terms

• Processing of data may only be done by data processors and data controllers may not do any processing

Are data controllers responsible to ensure data processors activity are limited to what is set forth under their agreements?

• Yes

• No

Based on the Indonesian PDP Law, which of the following is not considered as

specific personal data?

• Medical records

• Personal financial records

• Religion

• Criminal records

What should be included in the personal data register?

• Legal basis and purpose of processing of data

• Different categories of personal data involved

• Systems and locations where the personal data is processed

• All of the above

Under Indonesian PDP Law, within how long should data breaches should be reported?

• 1 x 24 hours

• 2 x 24 hours

• 3 x 24 hours

• Unspecified timeframe

Which of the following is not included as data subject rights under the PDP Law?

• Right to appoint data protection representative

• Right to rectification

• Right of erasure / right to be forgotten

• Right to object

Which of the following are valid legal basis?

• Explicit consent from data subject

• Performance of a contract

• Vital interest

• All of the above

Which of the following fulfills the requirements of explicit consent?

• A pre-ticked or preconfirmed

  consent statement

• Consent statement is written inside terms and conditions

• Individuals consciously do an action to affirm the consent statement (for example, "I consent that my data will be processed and used for marketing purposes")

• Consent statement is noted in a footnote or separate document

Under Indonesian PDP Law, within how long should data access request by individuals must be provided by the data controllers/processors?

• 1 x 24 hours

• 2 x 24 hours

• 3 x 24 hours

• Unspecified timeframe

Whose consent need to be collected in a special manner under the PDP Law?

• People with visual impairments

• People with hearing impairments

• Children

• All of the above