TACTICAL TRAINING

Under RA 10173, which of the following terms encompasses a range of operations—including collection, recording, organization, storage, adaptation, retrieval, consultation, use, consolidation, blocking, erasure, or destruction—performed on personal data, regardless of whether the operation is done manually or through automated means?

• Personal Data Configuration

• Personal Data Profiling Processes

• Personal Data Operational and Analytical Processing

• Personal Data Processing

Which legal basis under RA 10173 is specifically required when the processing of personal data is neither necessary for compliance with a legal obligation, fulfillment of a contract, protection of vital interests, performance of a public authority’s task, nor legitimate interests pursued by the personal information controller or third party?

• Privileged Communication

• Lawful Purpose

• Legitimate Interest

• Consent

Which compliance tool, although not explicitly mandated by name in RA 10173, is required under NPC Advisory No. 2017-03 for identifying, assessing, and mitigating risks to the rights and freedoms of data subjects prior to the launch of new or significantly modified processing systems involving sensitive personal information or high-risk data activities?

• Risk Register Analysis

• Anticipatory Security Report

• Privacy Impact Assessment

• Practical Interest Assessment

Under RA 10173 and its implementing rules, which entity bears the primary legal responsibility for ensuring the lawful processing of personal data, including compliance with data subject rights and breach notification requirements, even when the actual processing is outsourced to a third-party service provider?

• Data Protection Officer

• Personal Information Processor

• Personal Information Controller

• Joint Data Custodian

In accordance with RA 10173 and NPC Circulars, which formal document is required when two or more Personal Information Controllers agree to exchange personal data for a specific purpose, outside the scope of outsourcing, and must clearly define roles, safeguards, duration, and mechanisms for upholding data subject rights?

• Service Confidentiality Agreement

• Joint Data Business Processing Agreement

• Data Sharing Agreement

• Joint Processing Memorandum

Which of the following scenarios does NOT constitute valid consent under RA 10173 and related NPC issuances?

• A data subject ticks a box confirming agreement after reading a privacy notice describing the purpose, extent, and retention of data.

• A client signs a form authorizing a clinic to collect and store their medical history for diagnosis and treatment.

• A website assumes agreement to its privacy policy by a user’s continued browsing without any prompt or affirmative action.

• A.    An employee records verbal consent from a customer during a phone call, with the conversation clearly stating the data processing purpose.

Which of the following roles, though not vested with ultimate legal accountability for data processing activities, is required under RA 10173 to ensure organizational compliance by monitoring internal data handling practices, managing privacy risks, and serving as a liaison to the National Privacy Commission?

• Compliance Auditor

• Personal Information Controller

• Chief Information Officer

• Data Protection Officer

In large-scale organizations with complex data operations, which internal role—though not legally required by RA 10173—may be designated to assist in the implementation of privacy management programs, conduct routine compliance checks, and support the Data Protection Officer in enforcing internal data governance protocols?

• Privacy Operations Supervisor

• Compliance Officer for Privacy

• Risk Assessment Analyst

• Data Security Officer

Which of the following statements correctly reflects the extent of the enforcement powers of the National Privacy Commission (NPC) under RA 10173 with regard to criminal violations?

• The NPC may directly prosecute criminal cases related to data privacy violations before regular courts.

• The NPC may detain individuals found guilty of violating the Data Privacy Act.

• The NPC may issue criminal penalties through administrative proceedings.

• The NPC may refer violations of the Data Privacy Act to the Department of Justice for preliminary investigation and possible prosecution.

In the event of a personal data breach involving sensitive personal information or information that may be used to enable identity fraud, which of the following best describes the obligation of a Personal Information Controller in relation to timely breach reporting?

• Notify both the NPC and affected data subjects within 72 hours upon knowledge of or reasonable belief that a breach has occurred.

• Notify the data subject within 48 hours and submit a final report to the NPC within 30 days.

• Submit a breach log to the NPC within 5 working days and notify data subjects only upon written request.

• Wait until the results of an internal investigation by the DPO are completed before notifying the NPC and affected data subjects.