PDP9 試験問題を無料オンラインアクセス

Where a processor engages another processor ("sub-processor") to carry out processing activities on behalf of a controller, which of the following statements is CORRECT?

• A.The processor may use the sub-processor without the written authorisation of the controller if it adheres to an approved code of conduct
• B.The processor may use the sub-processor without the written authorisation of the controller if the processing is deemed to be low risk.
• C.The processor must receive prior written authorisation to use the sub-processor
• D.The processor may use the sub-processor without the written authorisation of the controller if the sub-processor signs a contract which reflects the same obligations as the contract with the controller

A UK public body has a security breach, in which the details of a hundred thousand members of the public are published What is the MAXIMUM fine that they could receive for this breach?

• A.£20 million or 2% of gross annual turnover
• B.£8.7 million or 2% of gross annual turnover
• C.£10 million or 4% of gross annual turnover
• D.£17 5 million or 4% of gross annual turnover

You are a consulting Data Protection Officer (DPO) for a holiday resort You have been asked to conduct a Data Protection Impact Assessment (DPIA) for them in advance of adopting a new HR management database.
While working through the DPIA, which of the following is NOT a requirement?

• A.Publish any potential risks in your information notice.
• B.Sign off and record outcomes.
• C.Describe the processing
• D.Identify measures to mitigate the risks

When does a personal data breach need to be reported to a supervisory authority?

• A.Only where a disclosure is of special category data
• B.All personal data breaches must be reported to a supervisory authority
• C.When the controller's right of freedom of expression outweighs the data subject's right to a private home and family life.
• D.Where the personal data breach is likely to result in a risk to the rights and freedoms of natural persons.

Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?

• A.It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
• B.It is key to the accountability element of the GDPR.
• C.It fulfils a requirement that data protection is carried out by design and default.
• D.It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated