PDPL

Which best defines a 'purpose' for processing in PDPL practice?

A A future possibility that might arise

B Any business improvement activity

C A specific, explicit, legitimate reason stated before collection

D Any internal use the organization prefers

A 'related purpose' is best interpreted as:

A Any internal purpose not disclosed publicly

B A purpose chosen by management discretion

C Any purpose that benefits the organization

D A purpose logically connected and reasonably expected from context

A cross-border transfer is most clearly unlawful when:

A The recipient is a well-known vendor

B Consent exists but regulatory conditions/approvals are not met

C The data is non-sensitive

D The transfer is encrypted

For cross-border transfers, which is the most fundamental requirement?

A Consent alone is always sufficient

B Encryption in transit and at rest

C Vendor is ISO certified

D Meeting the competent authority’s conditions/approvals

Which scenario most clearly constitutes unfair processing?

A Using data for a purpose the data subject would reasonably expect

B Using data for a hidden secondary purpose unrelated to the notice

C Restricting access to authorized staff

D Encrypting backups

Which item alone is least sufficient as evidence of compliance during an audit?

A Records of processing activities

B Technical controls without documented procedures or governance

C A published privacy notice

D A documented privacy policy

Which scenario most clearly violates fairness proportionality?

A Restricting access to HR records

B Encrypting employee data

C Using minimal data for onboarding verification

D Using collected ID data to build unrelated behavioral profiles

Lawful collection is primarily determined by:

A Encryption standard

B Valid lawful basis + specific purpose + transparency

C Data value to business

D Whether data is stored inside Saudi Arabia

Potential harm assessment depends most on:

A Total number of records only

B Nature, sensitivity, and context of the data and exposure

C Storage duration only

D Type of database software

Is data considered personal data if it identifies a person only when combined with other data?

A Only when linked externally

B No, indirect identification is excluded

C Yes, if identification is reasonably possible

D Only if the controller intends identification

Which practice most weakens accountability?

A Undefined responsibilities and no clear owner for privacy controls

B Conducting periodic privacy risk reviews

C Training staff on privacy basics

D Maintaining audit trails

Which is generally the most serious violation from a PDPL risk perspective?

A Late policy updates

B Processing sensitive personal data without a lawful basis

C Incomplete training records

D Minor documentation inconsistencies

Records of processing activities primarily support:

A System performance optimization

B Marketing effectiveness

C Vendor price benchmarking

D Accountability and demonstrable compliance

Which is the strongest indicator that data is 'indirectly identifiable'?

A It can be linked to a unique employee/customer identifier

B It is encrypted during transfer

C It is used only internally

D It is stored in a secure database

When does retention most clearly violate PDPL principles?

A When the purpose has ended and no lawful basis remains

B When retention is approved by IT

C When data is stored on-premises

D When data is retained in encrypted archives

The right of access most accurately includes:

A Receiving security logs only

B Obtaining the data and key information about processing (purposes, recipients, etc.)

C Ability to modify system configurations

D Unrestricted access to raw production databases

Work email such as 46633@company.com is personal data when:

A It is owned by the company

B It is used only for business messages

C It is not publicly known

D It can be linked (internally) to a specific employee identity

Is data considered personal data if it identifies a person only when combined with other data?

A Yes, if identification is reasonably possible

B Only if the controller intends identification

C No, indirect identification is excluded

D Only when linked externally

Using personal data after the relationship ends is best described as:

A Permitted if data is non-sensitive

B Permitted if management approves

C Permitted only if a continuing lawful basis exists (e.g., legal obligation)

D Always permitted if stored securely

Consent is most valid when it is:

A Specific, informed, and tied to a defined purpose

B Permanent for any future processing

C Implied from continued use of service in all cases

D Bundled into general terms without a clear option to refuse