PDPL Implementation (Advanced)

A subsidiary abroad needs customer data for its own marketing. What is the correct approach?

A Share if the data is encrypted only

B Treat as a transfer and meet lawful basis and cross-border conditions

C Share freely because it is the same group

D Share after removing names but keeping identifiers

Which example shows effective incident readiness?

A No incident plan because breaches are unlikely

B Rely solely on cyber insurance

C Only IT knows the plan, not business owners

D Tested incident playbooks with roles and escalation paths

A data subject asks to correct a wrong address. What is the best compliant response?

A Verify identity, correct across systems, and log the change

B Refuse because the data was collected last year

C Ask them to update next year

D Delete the entire account immediately

Which element is essential in records of processing to demonstrate accountability?

A Purpose, lawful basis, categories, recipients, and retention

B Hardware serial numbers

C Brand guidelines and design system

D Office seating chart

A vendor asks for broader access 'for support'. What should the controller do?

A Grant full admin to avoid downtime

B Grant least-privilege access with scope, logging, and time limits

C Allow access without updating the contract

D Share the master password

Before transferring personal data outside Saudi Arabia, what is the most fundamental requirement?

A Relying only on the vendor's ISO certificate

B Using a VPN for the transfer

C Using any foreign cloud as long as data is encrypted

D Meeting competent authority conditions/approvals and adequate protection

Which example most clearly shows an incompatible purpose?

A Using email to send a receipt

B Using phone to verify account security

C Using onboarding IDs to build unrelated behavior profiles

D Using address to deliver the purchased product

A user requests deletion, but legal retention is required. What is compliant?

A Ignore the request

B Charge a fee before acting

C Delete everything immediately

D Restrict processing, retain only what is legally required, and inform the user

Which factor should primarily drive data sensitivity classification?

A Storage cost and database size

B Database vendor and hosting provider

C Team size and org chart

D Potential harm from unauthorized disclosure or misuse

A cloud processor will manage payroll data. Which contract term is most critical for compliance?

A No audit or reporting obligations are needed

B Processor may reuse data to improve its services

C Processor acts only on documented instructions with security and subprocessor controls

D Processor owns derived insights and can resell them

What is the strongest technical control to enforce retention schedules?

A Automated deletion/archival tied to retention rules with audit logs

B Manual spreadsheet tracking of dates

C Annual policy reminder emails

D Encrypting backups only

Which evidence best shows access control implementation?

A Office location address

B Periodic access reviews with evidence of removals

C Server brand and model

D Number of employees hired this year

Which access-control design best enforces least privilege in a data-protection program?

A Shared admin accounts for efficiency

B Access granted on request with no expiry

C Role-based access with per-function permissions and periodic review

D Full access for all IT staff

Which scenario most likely requires a DPIA before launch?

A Refreshing the user interface colors

B Deploying facial recognition for access control at scale

C Archiving invoices for legal retention

D Sending service emails to existing customers

To align with fairness/proportionality when monitoring employee activity, which approach is best?

A Limit scope, inform employees, and minimize collection/retention

B Monitor all employee content 24/7

C Store all monitored content indefinitely

D Hide monitoring to avoid behavior changes

Which action best demonstrates privacy by design during development?

A Collect all data just in case

B Define minimal data fields and purposes in requirements and enforce in schema

C Run privacy review only after launch

D Skip impact assessment to meet the deadline

Which DPA clause most prevents a processor from becoming a controller?

A Processor may determine purposes of processing

B Processor can use data for its own analytics

C Processor owns derived insights and may reuse data

D Processor acts only on documented instructions and cannot decide purposes

A new system will process sensitive biometric data. What must be done before go-live?

A Ask the vendor to handle compliance

B Nothing if data is encrypted

C Only update the logo and branding

D Conduct a DPIA, implement safeguards, and obtain required approvals

An access request arrives from an email address. What should the controller do first?

A Verify the requester's identity proportionately before disclosure

B Require notarized ID for every request

C Provide the data immediately to avoid delays

D Reject all requests sent by email

Which action best reduces risk when sharing data with a third-party analytics provider?

A Share only necessary fields, de-identify where possible, and sign a DPA

B Publish the data publicly for transparency

C Share without a contract to speed up

D Share full datasets to maximize accuracy