PDPL

Which item should be documented to best support accountability?

A Server brand and model

B The lawful basis and purpose for each processing activity

C Office seating chart

D Employee shift schedule

Which scenario most clearly constitutes unfair processing?

A Using data for a purpose the data subject would reasonably expect

B Using data for a hidden secondary purpose unrelated to the notice

C Restricting access to authorized staff

D Encrypting backups

Which practice is a violation even if a general consent exists?

A Processing strictly within the originally stated purpose

B Expanding processing to a new purpose not disclosed at collection

C Applying encryption at rest

D Implementing role-based access control (RBAC)

A 'related purpose' is best interpreted as:

A Any purpose that benefits the organization

B A purpose logically connected and reasonably expected from context

C Any internal purpose not disclosed publicly

D A purpose chosen by management discretion

Which rationale is least defensible for sharing personal data with a third party?

A Explicit informed consent for a defined purpose

B A legal obligation requiring disclosure

C Contract performance necessity involving that third party

D Internal convenience to reduce workload

Which factor determines whether a corporate email account is personal data?

A Whether the mailbox is owned by the company

B Whether the account can be linked to a natural person

C Whether it contains the employee’s full name

D Whether the email is publicly visible on a website

Records of processing activities primarily support:

A Marketing effectiveness

B Accountability and demonstrable compliance

C System performance optimization

D Vendor price benchmarking

Consent is most valid when it is:

A Bundled into general terms without a clear option to refuse

B Specific, informed, and tied to a defined purpose

C Implied from continued use of service in all cases

D Permanent for any future processing

Which is a high-risk 'paper compliance' indicator?

A Assigning a DPO without authority, resources, or escalation route

B Maintaining audit logs

C Running periodic access reviews

D Classifying data by sensitivity

Which is the strongest compliance red flag in a privacy notice?

A Specific purposes listed per processing activity

B Broad undefined purposes like 'improving our services' without scope

C Retention periods per category

D Clear rights request instructions

Which scenario most clearly violates fairness proportionality?

A Using minimal data for onboarding verification

B Using collected ID data to build unrelated behavioral profiles

C Restricting access to HR records

D Encrypting employee data

Which organizational setup most undermines DPO independence?

A DPO advises project teams on privacy controls

B DPO reports to the unit being audited/monitored

C DPO has direct access to top management

D DPO can access processing records

Business-card contact details are best classified as:

A Sensitive personal data

B Personal data (non-sensitive)

C Public data that is not regulated

D Corporate data only

Which factor does NOT materially affect whether something is personal data?

A Identifiability (direct/indirect)

B Context of use and available linkages

C Storage cost or database size

D Ability to associate to a natural person

Distributing a business card most accurately implies:

A Unlimited consent for any future use

B Limited implied consent for professional contact in context

C Consent only if a written consent form is signed

D No consent because data was shared voluntarily

Retaining personal data 'in case we need it later' primarily violates:

A Data integrity

B Purpose limitation and minimization

C Encryption requirements

D Physical security controls

For cross-border transfers, which is the most fundamental requirement?

A Encryption in transit and at rest

B Meeting the competent authority’s conditions/approvals

C Vendor is ISO certified

D Consent alone is always sufficient

Which indicates superficial compliance most clearly?

A Policies exist but are not implemented or monitored

B Active governance with KPIs

C Incident response drills

D Vendor due diligence reviews

Potential harm assessment depends most on:

A Total number of records only

B Nature, sensitivity, and context of the data and exposure

C Type of database software

D Storage duration only

Which practice most weakens accountability?

A Undefined responsibilities and no clear owner for privacy controls

B Maintaining audit trails

C Conducting periodic privacy risk reviews

D Training staff on privacy basics