GDPR for Employees Course (EU): The data protection principles

1. Question 1 of 16

   Article 5(1) GDPR lists six principles. Which extra principle in Article 5(2) says the controller must be able to show it complies?

   • AProportionality
   • BTransparency
   • CAvailability
   • DAccountability
   Show answer

   Answer: D. Accountability

   Article 5(2) GDPR: the controller is responsible for, and must be able to demonstrate, compliance (accountability).

2. Question 2 of 16

   What does the principle of data minimisation mean?

   • ADelete all personal data at the end of every single month
   • BSave personal data using the smallest possible file size
   • CCollect as much data as possible in case it is useful later
   • DUse only data that is adequate, relevant and necessary
   Show answer

   Answer: D. Use only data that is adequate, relevant and necessary

   Article 5(1)(c) GDPR: personal data must be adequate, relevant and limited to what is necessary for the purpose.

3. Question 3 of 16

   What does the principle of purpose limitation mean?

   • AData is collected for clear purposes and not reused in incompatible ways
   • BData may be used for any purpose once the organisation has collected it
   • CData may only ever be used by the one department that collected it
   • DData may only be collected for the purpose of selling products or services
   Show answer

   Answer: A. Data is collected for clear purposes and not reused in incompatible ways

   Article 5(1)(b) GDPR: data is collected for specified, explicit and legitimate purposes and not further processed in an incompatible way.

4. Question 4 of 16

   What does the principle of storage limitation mean?

   • AData must all be stored on a single server in the organisation
   • BData must be kept for at least ten years in every single case
   • CData must only ever be stored on servers inside the EU
   • DData that identifies people is kept only as long as needed
   Show answer

   Answer: D. Data that identifies people is kept only as long as needed

   Article 5(1)(e) GDPR: data must be kept in identifiable form no longer than necessary for its purposes.

5. Question 5 of 16

   You notice that a customer's phone number in your system is wrong. Which principle says it should be corrected without delay?

   • AAccuracy
   • BStorage limitation
   • CPurpose limitation
   • DData minimisation
   Show answer

   Answer: A. Accuracy

   Article 5(1)(d) GDPR: data must be accurate and, where necessary, kept up to date; inaccurate data must be erased or corrected without delay.

6. Question 6 of 16

   Which principle requires appropriate security, including protection against accidental loss or damage?

   • AFairness and transparency
   • BAccuracy and quality
   • CIntegrity and confidentiality
   • DPurpose and storage limitation
   Show answer

   Answer: C. Integrity and confidentiality

   Article 5(1)(f) GDPR requires appropriate security using technical or organisational measures (integrity and confidentiality).

7. Question 7 of 16

   Which principle means people must be told clearly how their personal data will be used?

   • AStorage limitation
   • BTransparency
   • CIntegrity and confidentiality
   • DData minimisation
   Show answer

   Answer: B. Transparency

   Article 5(1)(a) GDPR: data must be processed lawfully, fairly and in a transparent manner.

8. Question 8 of 16

   Who is responsible for being able to demonstrate compliance with the principles?

   • AEach data subject
   • BThe European Commission
   • CThe national authority
   • DThe controller
   Show answer

   Answer: D. The controller

   Under Article 5(2) GDPR, the controller is responsible for, and must be able to demonstrate, compliance.

9. Question 9 of 16

   Which practice best supports the storage limitation principle?

   • AMaking extra backup copies of every old file you have
   • BSetting retention periods and a deletion procedure
   • CMoving old files to your own personal drive at home
   • DPrinting out old records before they are archived
   Show answer

   Answer: B. Setting retention periods and a deletion procedure

   The EDPB says storage limitation calls for retention periods and a procedure to delete or anonymise data that is no longer needed.

10. Question 10 of 16

    Must an organisation's record of processing activities be made public?

    • ANo, but the data protection authority can ask to see it
    • BNo, there is no need to keep such a record
    • CYes, it must be published on the website
    • DYes, it must be sent to every employee
    Show answer

    Answer: A. No, but the data protection authority can ask to see it

    The EDPB explains that the record of processing does not have to be public, but it must be available to the data protection authority on request.

11. Question 11 of 16

    Which of these is a technical measure that supports integrity and confidentiality?

    • AWriting a longer privacy notice for all customers
    • BAdding more fields to the customer sign-up form
    • CKeeping customer records for a longer period of time
    • DEncrypting laptops that hold personal data
    Show answer

    Answer: D. Encrypting laptops that hold personal data

    Article 32 GDPR names encryption and pseudonymisation as examples of security measures.

12. Question 12 of 16

    Staff gave emergency contact numbers for use in emergencies. A manager wants to use them to invite families to a sales event. Which principle is most at risk?

    • AAccountability
    • BPurpose limitation
    • CData minimisation
    • DAccuracy
    Show answer

    Answer: B. Purpose limitation

    The numbers were collected for emergencies. Using them for marketing is a new purpose that is not compatible with the original one.

13. Question 13 of 16

    An application form for an office job asks for the applicant's blood type. Which principle does this most clearly break?

    • AAccountability
    • BStorage limitation
    • CAccuracy
    • DData minimisation
    Show answer

    Answer: D. Data minimisation

    Blood type is not necessary to assess an office job application, so collecting it goes beyond what is necessary (and it is also health data).

14. Question 14 of 16

    A team keeps CVs from unsuccessful applicants "forever, just in case". Which principle does this conflict with most?

    • APurpose limitation
    • BStorage limitation
    • CTransparency
    • DAccuracy
    Show answer

    Answer: B. Storage limitation

    Storage limitation means data is kept no longer than necessary. Keeping it forever with no reason breaks this principle.

15. Question 15 of 16

    Read the memo. Letting every employee open a list of home addresses and salaries conflicts most directly with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CStorage limitation
    • DLawfulness, fairness and transparency
    Show answer

    Answer: A. Integrity and confidentiality

    Article 5(1)(f) GDPR requires protection against unauthorised access. Most staff do not need other people's addresses and salaries for their work.

16. Question 16 of 16

    Read the memo. Keeping 15 years of old staff lists because "we might need them one day" conflicts most with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CLawfulness, fairness and transparency
    • DStorage limitation
    Show answer

    Answer: D. Storage limitation

    Data must not be kept longer than necessary. "Might need it one day" is not a reason to keep old lists.

Keyboard: 1–4 to answer, Enter for the next question.