PDPF 試験問題を無料オンラインアクセス

What is the main purpose of the General Data Protection Regulation (GDPR)?

• A.Protect confidential business data.
• B.Protecting the data of everyone in Europe.
• C.Protect the data of everyone in the world.
• D.Protect data of data subjects located in the European Economic Area (EEA), regardless of the country of processing.

What does the principle of 'data minimization' mean?

• A.Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
• B.Personal data shall be processed in a manner that ensures appropriate security of the personal data.
• C.Personal data shall be accurate and where necessary kept up to date.
• D.Personal data shall be adequate and limited to what is necessary for the purposes of the processing.

A company located in France wishes to enter into a compulsory contract with a processor located in Portugal. This contract aims to process sensitive French personal dat a. The Portuguese Supervisory Authority is informed about this contract and the type of processing.
How should Portuguese Supervisory Authority proceed, in accordance with the General Data Protection Regulation (GDPR)?

• A.Report the data processing to the French Supervisory Authority, which must take over the supervision.
• B.Verify that adequate compulsory contracts have been established and leave supervision to the French Supervisory Authority.
• C.Supervise the processing of personal data according to the guidelines of the Supervisory Authority of Portugal.
• D.Supervise the processing of personal data in accordance with the French Supervisory Authority legislation.

When is a Data Protection Impact Assessment (DPIA) under the General Data Protection Regulation (GDPR) mandatory?

• A.Application of new technologies that may imply a high risk to the rights and freedoms of data subjects.
• B.There is no security policy and information security risk analysis.
• C.In all types of personal data processing.

After notifying the supervisory authority, what should be the first action the controller must take when it finds a security breach where unauthorized people have accessed personal data?

• A.Register a Police Report at the cybercrime station.
• B.Notify data subjects that have been subject to a security breach.
• C.Analyze whether sensitive data has been accessed.
• D.Contact the DPO for formal notification to the Supervisory Authority.