PDPL Implementation (Advanced)

A dataset is pseudonymized but the key is retained by the controller. Which statement is correct?

A It is fully anonymized and outside PDPL scope

B It can be shared freely without any controls

C It remains personal data because re-identification is possible with the key

D Security controls are no longer necessary

A vendor asks for broader access 'for support'. What should the controller do?

A Grant full admin to avoid downtime

B Grant least-privilege access with scope, logging, and time limits

C Share the master password

D Allow access without updating the contract

An HR portal asks for employees' family medical history 'for future benefits'. What aligns with data minimization?

A Remove the field unless a defined purpose and lawful basis exist now

B Collect it and keep indefinitely if encrypted

C Collect it because HR may need it someday

D Collect it if employees do not complain

An access request arrives from an email address. What should the controller do first?

A Provide the data immediately to avoid delays

B Verify the requester's identity proportionately before disclosure

C Reject all requests sent by email

D Require notarized ID for every request

Which action best reduces risk when sharing data with a third-party analytics provider?

A Share only necessary fields, de-identify where possible, and sign a DPA

B Share full datasets to maximize accuracy

C Share without a contract to speed up

D Publish the data publicly for transparency

Which evidence best shows access control implementation?

A Periodic access reviews with evidence of removals

B Number of employees hired this year

C Server brand and model

D Office location address

To align with fairness/proportionality when monitoring employee activity, which approach is best?

A Monitor all employee content 24/7

B Hide monitoring to avoid behavior changes

C Store all monitored content indefinitely

D Limit scope, inform employees, and minimize collection/retention

For API logs that may include personal data, which practice best reduces exposure while preserving auditability?

A Log full payloads including identifiers

B Disable logging entirely

C Mask/tokenize sensitive fields and log only necessary metadata

D Store logs indefinitely for safety

What is the strongest technical control to enforce retention schedules?

A Automated deletion/archival tied to retention rules with audit logs

B Annual policy reminder emails

C Encrypting backups only

D Manual spreadsheet tracking of dates

Which example shows effective incident readiness?

A No incident plan because breaches are unlikely

B Only IT knows the plan, not business owners

C Tested incident playbooks with roles and escalation paths

D Rely solely on cyber insurance

Developers request real customer data to test a new feature. What is the compliant approach?

A Copy the production database into dev with full access

B Use production data unmasked if the network is internal

C Use anonymized/masked datasets with restricted access and logging

D Give interns access to production for faster testing

Before transferring personal data outside Saudi Arabia, what is the most fundamental requirement?

A Using any foreign cloud as long as data is encrypted

B Relying only on the vendor's ISO certificate

C Using a VPN for the transfer

D Meeting competent authority conditions/approvals and adequate protection

When is notifying data subjects typically required?

A For every incident regardless of impact

B Only after a regulator explicitly instructs it

C Only if systems were patched within 24 hours

D When the breach is likely to cause harm to data subjects

Which DPA clause most prevents a processor from becoming a controller?

A Processor may determine purposes of processing

B Processor owns derived insights and may reuse data

C Processor acts only on documented instructions and cannot decide purposes

D Processor can use data for its own analytics

A vendor uses customer data to train its own models beyond your instructions. What is its role for that use?

A A pure processor only

B The data subject

C Outside PDPL scope because data is derived

D A controller or joint controller for that use

Which key-management practice most strengthens protection of encrypted data?

A Store encryption keys in the same database as the data

B Share keys via email among the team

C Use centralized KMS with rotation and strict access logging

D Hardcode keys inside the application

Which access-control design best enforces least privilege in a data-protection program?

A Shared admin accounts for efficiency

B Role-based access with per-function permissions and periodic review

C Full access for all IT staff

D Access granted on request with no expiry

Which scenario most likely requires a DPIA before launch?

A Refreshing the user interface colors

B Sending service emails to existing customers

C Archiving invoices for legal retention

D Deploying facial recognition for access control at scale

Which example most clearly shows an incompatible purpose?

A Using address to deliver the purchased product

B Using email to send a receipt

C Using onboarding IDs to build unrelated behavior profiles

D Using phone to verify account security

A new system will process sensitive biometric data. What must be done before go-live?

A Nothing if data is encrypted

B Only update the logo and branding

C Ask the vendor to handle compliance

D Conduct a DPIA, implement safeguards, and obtain required approvals