GDPR for Employees Course (EU): The data protection principles

1. السؤال 1 من 16

   Article 5(1) GDPR lists six principles. Which extra principle in Article 5(2) says the controller must be able to show it complies?

   • AProportionality
   • BTransparency
   • CAvailability
   • DAccountability
   أظهر الإجابة

   الإجابة: D. Accountability

   Article 5(2) GDPR: the controller is responsible for, and must be able to demonstrate, compliance (accountability).

2. السؤال 2 من 16

   What does the principle of data minimisation mean?

   • ADelete all personal data at the end of every single month
   • BSave personal data using the smallest possible file size
   • CCollect as much data as possible in case it is useful later
   • DUse only data that is adequate, relevant and necessary
   أظهر الإجابة

   الإجابة: D. Use only data that is adequate, relevant and necessary

   Article 5(1)(c) GDPR: personal data must be adequate, relevant and limited to what is necessary for the purpose.

3. السؤال 3 من 16

   What does the principle of purpose limitation mean?

   • AData is collected for clear purposes and not reused in incompatible ways
   • BData may be used for any purpose once the organisation has collected it
   • CData may only ever be used by the one department that collected it
   • DData may only be collected for the purpose of selling products or services
   أظهر الإجابة

   الإجابة: A. Data is collected for clear purposes and not reused in incompatible ways

   Article 5(1)(b) GDPR: data is collected for specified, explicit and legitimate purposes and not further processed in an incompatible way.

4. السؤال 4 من 16

   What does the principle of storage limitation mean?

   • AData must all be stored on a single server in the organisation
   • BData must be kept for at least ten years in every single case
   • CData must only ever be stored on servers inside the EU
   • DData that identifies people is kept only as long as needed
   أظهر الإجابة

   الإجابة: D. Data that identifies people is kept only as long as needed

   Article 5(1)(e) GDPR: data must be kept in identifiable form no longer than necessary for its purposes.

5. السؤال 5 من 16

   You notice that a customer's phone number in your system is wrong. Which principle says it should be corrected without delay?

   • AAccuracy
   • BStorage limitation
   • CPurpose limitation
   • DData minimisation
   أظهر الإجابة

   الإجابة: A. Accuracy

   Article 5(1)(d) GDPR: data must be accurate and, where necessary, kept up to date; inaccurate data must be erased or corrected without delay.

6. السؤال 6 من 16

   Which principle requires appropriate security, including protection against accidental loss or damage?

   • AFairness and transparency
   • BAccuracy and quality
   • CIntegrity and confidentiality
   • DPurpose and storage limitation
   أظهر الإجابة

   الإجابة: C. Integrity and confidentiality

   Article 5(1)(f) GDPR requires appropriate security using technical or organisational measures (integrity and confidentiality).

7. السؤال 7 من 16

   Which principle means people must be told clearly how their personal data will be used?

   • AStorage limitation
   • BTransparency
   • CIntegrity and confidentiality
   • DData minimisation
   أظهر الإجابة

   الإجابة: B. Transparency

   Article 5(1)(a) GDPR: data must be processed lawfully, fairly and in a transparent manner.

8. السؤال 8 من 16

   Who is responsible for being able to demonstrate compliance with the principles?

   • AEach data subject
   • BThe European Commission
   • CThe national authority
   • DThe controller
   أظهر الإجابة

   الإجابة: D. The controller

   Under Article 5(2) GDPR, the controller is responsible for, and must be able to demonstrate, compliance.

9. السؤال 9 من 16

   Which practice best supports the storage limitation principle?

   • AMaking extra backup copies of every old file you have
   • BSetting retention periods and a deletion procedure
   • CMoving old files to your own personal drive at home
   • DPrinting out old records before they are archived
   أظهر الإجابة

   الإجابة: B. Setting retention periods and a deletion procedure

   The EDPB says storage limitation calls for retention periods and a procedure to delete or anonymise data that is no longer needed.

10. السؤال 10 من 16

    Must an organisation's record of processing activities be made public?

    • ANo, but the data protection authority can ask to see it
    • BNo, there is no need to keep such a record
    • CYes, it must be published on the website
    • DYes, it must be sent to every employee
    أظهر الإجابة

    الإجابة: A. No, but the data protection authority can ask to see it

    The EDPB explains that the record of processing does not have to be public, but it must be available to the data protection authority on request.

11. السؤال 11 من 16

    Which of these is a technical measure that supports integrity and confidentiality?

    • AWriting a longer privacy notice for all customers
    • BAdding more fields to the customer sign-up form
    • CKeeping customer records for a longer period of time
    • DEncrypting laptops that hold personal data
    أظهر الإجابة

    الإجابة: D. Encrypting laptops that hold personal data

    Article 32 GDPR names encryption and pseudonymisation as examples of security measures.

12. السؤال 12 من 16

    Staff gave emergency contact numbers for use in emergencies. A manager wants to use them to invite families to a sales event. Which principle is most at risk?

    • AAccountability
    • BPurpose limitation
    • CData minimisation
    • DAccuracy
    أظهر الإجابة

    الإجابة: B. Purpose limitation

    The numbers were collected for emergencies. Using them for marketing is a new purpose that is not compatible with the original one.

13. السؤال 13 من 16

    An application form for an office job asks for the applicant's blood type. Which principle does this most clearly break?

    • AAccountability
    • BStorage limitation
    • CAccuracy
    • DData minimisation
    أظهر الإجابة

    الإجابة: D. Data minimisation

    Blood type is not necessary to assess an office job application, so collecting it goes beyond what is necessary (and it is also health data).

14. السؤال 14 من 16

    A team keeps CVs from unsuccessful applicants "forever, just in case". Which principle does this conflict with most?

    • APurpose limitation
    • BStorage limitation
    • CTransparency
    • DAccuracy
    أظهر الإجابة

    الإجابة: B. Storage limitation

    Storage limitation means data is kept no longer than necessary. Keeping it forever with no reason breaks this principle.

15. السؤال 15 من 16

    Read the memo. Letting every employee open a list of home addresses and salaries conflicts most directly with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CStorage limitation
    • DLawfulness, fairness and transparency
    أظهر الإجابة

    الإجابة: A. Integrity and confidentiality

    Article 5(1)(f) GDPR requires protection against unauthorised access. Most staff do not need other people's addresses and salaries for their work.

16. السؤال 16 من 16

    Read the memo. Keeping 15 years of old staff lists because "we might need them one day" conflicts most with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CLawfulness, fairness and transparency
    • DStorage limitation
    أظهر الإجابة

    الإجابة: D. Storage limitation

    Data must not be kept longer than necessary. "Might need it one day" is not a reason to keep old lists.

لوحة المفاتيح: 1–4 للإجابة، وEnter للسؤال التالي.