S2 GDPR Quiz

What is the main goal of the General Data Protection Regulation (GDPR)?

• To increase business profits through data

• To protect user data and privacy

• To restrict international data transfers

• To promote data sharing between organizations

Answer explanation

The main goal of the General Data Protection Regulation (GDPR) is to protect user data and privacy.

Which of the following is NOT one of the data protection principles under GDPR?

• Lawfulness, fairness, and transparency

• Only keeping data as long as it is needed.

• Only storing a maximum amount of data.

• Using data for a specific, stated reason

Answer explanation

The correct choice is 'Only storing a maximum amount of data.' because it is not one of the data protection principles under GDPR.

What does the 'right to access' under GDPR entitle a data subject to do?

• Delete personal data

• Receive a copy of their personal data

• Make unlimited data requests

• Sell their personal data

Answer explanation

The 'right to access' under GDPR entitles a data subject to receive a copy of their personal data, not to delete, make unlimited requests, or sell it.

Imagine a scenario where a school, to improve its teaching methods, collects data about its students. Which principle requires that the data collected must be for specified, explicit, and legitimate purposes?

• Purpose limitation

• Data minimization

• Accuracy

• Storage limitation

Answer explanation

The principle that requires data collected to be for specified, explicit, and legitimate purposes is Purpose limitation.

Under GDPR, what is required for lawful processing of personal data?

• Consent from the data subject

• A large payment to the data protection authority

• Notification to competitors

• Public announcement of the data usage

Answer explanation

Under GDPR, lawful processing of personal data requires consent from the data subject.

What does the 'right to rectification' allow individuals to do?

• Transfer their data to another country

• Receive financial compensation for data breaches

• Correct inaccurate personal data

• Use data without restrictions

Answer explanation

The 'right to rectification' allows individuals to correct inaccurate personal data, not transfer data, receive compensation, or use data without restrictions.

Which GDPR principle states that personal data should be kept secure from unauthorized access?

• Transparency

• Integrity and confidentiality

• Accountability

• Lawfulness

Answer explanation

The GDPR principle that states personal data should be kept secure from unauthorized access is Integrity and confidentiality.

What is the 'right to be forgotten' also known as?

• Right to erasure

• Right to object

• Right to data portability

• Right to access

Answer explanation

The 'right to be forgotten' is also known as the 'Right to erasure', allowing individuals to request the deletion of their personal data.

Which of the following is a requirement under the data minimization principle of GDPR?

• Collect as much personal data as possible

• Only collect personal data that is necessary for the specified purpose

• Store data indefinitely

• Share data freely with third parties

Answer explanation

Only collect personal data that is necessary for the specified purpose is a requirement under the data minimization principle of GDPR.

What does the 'right to data portability' allow a data subject to do?

• Request deletion of data after one year

• Move, copy, or transfer personal data easily from one IT environment to another

• Sell their personal data to the highest bidder

• Ignore data protection laws

Answer explanation

Move, copy, or transfer personal data easily from one IT environment to another