GDPR for Employees Course (EU) 2026

1. السؤال 1 من 16

   What does the abbreviation GDPR stand for?

   • AGeneral Data Protection Regulation
   • BGlobal Data Privacy and Records Rules
   • CGuide to Data Processing Rights
   • DGeneral Directive on Personal Records
   أظهر الإجابة

   الإجابة: A. General Data Protection Regulation

   GDPR is the General Data Protection Regulation, Regulation (EU) 2016/679.

2. السؤال 2 من 16

   Since which date has the GDPR applied across the EU?

   • A25 May 2018
   • B1 January 2020
   • C24 May 2016
   • D25 May 2016
   أظهر الإجابة

   الإجابة: A. 25 May 2018

   The GDPR entered into force on 24 May 2016 and has applied since 25 May 2018.

3. السؤال 3 من 16

   Under the GDPR, personal data is information that relates to whom?

   • AOnly people who have signed a contract with you
   • BAny company, charity or other organisation
   • COnly people who are citizens of an EU country
   • DAn identified or identifiable living person
   أظهر الإجابة

   الإجابة: D. An identified or identifiable living person

   Personal data is any information relating to an identified or identifiable living individual, called the data subject.

4. السؤال 4 من 16

   Which of these is personal data?

   • AA company's official registration number
   • BA shared company mailbox such as info@example.com
   • CThe work email marta.novak@example.com
   • DRegional sales totals that were fully anonymised
   أظهر الإجابة

   الإجابة: C. The work email marta.novak@example.com

   An email address that points to one person is personal data. Company numbers, generic company addresses and irreversibly anonymised data are not.

5. السؤال 5 من 16

   What is the person that personal data is about called?

   • AThe data processor
   • BThe data recipient
   • CThe data controller
   • DThe data subject
   أظهر الإجابة

   الإجابة: D. The data subject

   Article 4(1) GDPR calls the identified or identifiable person the data subject.

6. السؤال 6 من 16

   Which of these belongs to the special categories of personal data?

   • AA person's direct work phone number
   • BA person's start date with the company
   • CData about a person's health
   • DA person's job title and department
   أظهر الإجابة

   الإجابة: C. Data about a person's health

   Health data is one of the special categories in Article 9 GDPR, which need extra protection.

7. السؤال 7 من 16

   Which statement best describes "processing" under the GDPR?

   • AOnly changing personal data in some way after it has first been collected
   • BOnly storing personal data on a computer system for longer than one month
   • CAny operation on personal data, from collecting and viewing it to deleting it
   • DOnly sending personal data to people outside the organisation that collected it
   أظهر الإجابة

   الإجابة: C. Any operation on personal data, from collecting and viewing it to deleting it

   Article 4(2) GDPR defines processing very widely, from collection and consultation to disclosure, erasure and destruction.

8. السؤال 8 من 16

   In a staff survey, names are replaced with codes and the list linking codes to names is kept separately. What is the survey data now?

   • ASpecial category data in every case
   • BPersonal data only if it is published
   • CAnonymous data that is outside the GDPR
   • DStill personal data, as it can be linked back to people
   أظهر الإجابة

   الإجابة: D. Still personal data, as it can be linked back to people

   Pseudonymised data can be used to re-identify people, so it remains personal data under the GDPR.

9. السؤال 9 من 16

   When does information stop being personal data?

   • AWhen it is stored in a locked filing cabinet
   • BWhen it is encrypted with a strong password
   • CWhen names are swapped for reference numbers
   • DWhen it is anonymised so that nobody can ever be identified again
   أظهر الإجابة

   الإجابة: D. When it is anonymised so that nobody can ever be identified again

   Only data anonymised so that no one can be identified, irreversibly, falls outside the GDPR. Encrypted and pseudonymised data are still personal data.

10. السؤال 10 من 16

    What is the organisation that decides why and how personal data is processed called?

    • AThe processor
    • BThe data subject
    • CThe supervisory authority
    • DThe controller
    أظهر الإجابة

    الإجابة: D. The controller

    Article 4(7) GDPR: the controller determines the purposes and means of the processing.

11. السؤال 11 من 16

    A company uses an outside payroll provider, which pays staff on the company's instructions. What is the payroll provider usually?

    • AA processor
    • BThe controller
    • CA supervisory authority
    • DA data subject
    أظهر الإجابة

    الإجابة: A. A processor

    A processor processes personal data on behalf of the controller. The EDPB gives a payroll company as an example.

12. السؤال 12 من 16

    Who enforces the GDPR in each EU country?

    • AAn independent national data protection authority
    • BThe European Commission in every case
    • CThe national tax office
    • DEach organisation's own data protection officer
    أظهر الإجابة

    الإجابة: A. An independent national data protection authority

    Each EEA country has its own independent data protection authority, which handles complaints, investigates and can impose sanctions.

13. السؤال 13 من 16

    Pavel keeps an address book of his friends' birthdays at home, just for himself. Does the GDPR apply to it?

    • ANo, purely personal or household activities are outside it
    • BYes, the GDPR covers all personal data kept anywhere in the EU
    • CYes, because a date of birth is a special category of data
    • DOnly if the address book has more than 50 entries in it
    أظهر الإجابة

    الإجابة: A. No, purely personal or household activities are outside it

    Article 2(2)(c) GDPR excludes processing by a person in a purely personal or household activity. Data you handle at work is not covered by this exception.

14. السؤال 14 من 16

    According to the GDPR recitals, which can set more specific rules on processing employees' personal data?

    • AOnly guidance from trade associations
    • BNational law or collective agreements, such as works agreements
    • COnly each employer's privacy notice
    • DOnly each worker's employment contract
    أظهر الإجابة

    الإجابة: B. National law or collective agreements, such as works agreements

    Recital 155 says Member State law or collective agreements, including works agreements, may set specific rules for employee data. National rules therefore differ.

15. السؤال 15 من 16

    Read the description. What kind of data is in column D?

    Clara works at the front desk of Northfield Clinic. Her manager asks her to tidy up a spreadsheet called "visits.xlsx". It has these columns:

    Column A: patient code (for example P-1047)
    Column B: first name
    Column C: date of visit
    Column D: reason for visit (for example "asthma check")
    Column E: email address (for example j.doe@example.com)

    • AOrdinary personal data that needs no extra protection
    • BSpecial category data, because it concerns health
    • CData about criminal convictions and offences
    • DNot personal data, because no name is in that column
    أظهر الإجابة

    الإجابة: B. Special category data, because it concerns health

    The reason for a clinic visit, such as an asthma check, is data concerning health, a special category under Article 9 GDPR.

16. السؤال 16 من 16

    Read the description. Clara suggests deleting column B so the file is "anonymous". Is she right?

    Clara works at the front desk of Northfield Clinic. Her manager asks her to tidy up a spreadsheet called "visits.xlsx". It has these columns:

    Column A: patient code (for example P-1047)
    Column B: first name
    Column C: date of visit
    Column D: reason for visit (for example "asthma check")
    Column E: email address (for example j.doe@example.com)

    • ANo, because clinics are never allowed to delete any data
    • BYes, as long as the file is also given a new name
    • CYes, without first names nobody at all can be identified
    • DNo, the codes and email addresses still identify people
    أظهر الإجابة

    الإجابة: D. No, the codes and email addresses still identify people

    Data is only anonymous if no one can be identified. Codes that link to patient records and email addresses still identify people, so it stays personal data.

لوحة المفاتيح: 1–4 للإجابة، وEnter للسؤال التالي.