GDPR for Employees Course (EU): Everyday safeguards at work

1. Question 1 of 17

   As an employee, when may you use personal data that your employer holds?

   • AFor your own purposes, if you delete it afterwards
   • BOnly for the tasks you are instructed to do
   • CWhenever a friend or relative asks you politely
   • DWhenever you have system access to that data
   Show answer

   Answer: B. Only for the tasks you are instructed to do

   Article 29 GDPR: anyone acting under the authority of the controller may process personal data only on the controller's instructions.

2. Question 2 of 17

   A well-known person is a customer. A colleague opens their record just out of curiosity. Is that acceptable?

   • ANo, viewing it is processing outside their job
   • BYes, because only looking at data is not processing
   • CYes, if the record does not include any health data
   • DYes, as long as the colleague does not tell anyone
   Show answer

   Answer: A. No, viewing it is processing outside their job

   Consultation (looking up) is processing under Article 4(2), and staff may only process data on the controller's instructions.

3. Question 3 of 17

   What does "need-to-know" access mean?

   • AEveryone can see all data but must ask before changing it
   • BManagers can always see every record their team can see
   • CData is shared with anyone in the company who asks for it
   • DPeople can open only the data their role needs
   Show answer

   Answer: D. People can open only the data their role needs

   The EDPB recommends granting access on a need-to-know basis with different access profiles.

4. Question 4 of 17

   A colleague asks to use your login to save time while theirs is being set up. What should you do?

   • AWrite your password on a sticky note for them
   • BRefuse: everyone needs their own account
   • CAgree, and change your password afterwards
   • DAgree, as long as they only use it for one day
   Show answer

   Answer: B. Refuse: everyone needs their own account

   The EDPB recommends a unique identifier for each user and no shared accounts.

5. Question 5 of 17

   You leave your desk to get a coffee. What should you do with your computer?

   • ATurn the monitor brightness down
   • BClose only the email program
   • CLock the screen before you walk away
   • DLeave it, as the screen locks itself later
   Show answer

   Answer: C. Lock the screen before you walk away

   The EDPB lists locking your screen while you are away as a basic measure. An automatic lock only starts after some time, so lock it yourself.

6. Question 6 of 17

   At the end of the day, what should you do with paper files that contain personal data?

   • ATurn them face down on the desk
   • BTake them home to finish them later
   • CLock them in a drawer or cabinet
   • DLeave them in a neat pile on the desk
   Show answer

   Answer: C. Lock them in a drawer or cabinet

   Paper records need protection too. The EDPB recommends a clean desk policy and keeping documents in a locked drawer or room.

7. Question 7 of 17

   You must email the same notice to 40 external customers. How should you add their addresses?

   • AIn the To field, so everyone sees who got it
   • BIn the CC field, so replies go to everyone
   • CIn the subject line, so it is easy to sort
   • DIn the BCC field, so the addresses stay hidden
   Show answer

   Answer: D. In the BCC field, so the addresses stay hidden

   The EDPB recommends putting multiple recipients in BCC by default so customers cannot see each other's addresses.

8. Question 8 of 17

   Your email program fills in addresses automatically. Why should you check the recipient before sending?

   • AIt always sends a hidden copy to the IT team
   • BIt turns off encryption for that email
   • CIt removes any attachment that is very large
   • DIt may pick the wrong person with a similar name
   Show answer

   Answer: D. It may pick the wrong person with a similar name

   Sending to the wrong recipient is a common breach. The EDPB suggests checks such as disabling autocomplete and confirming recipients.

9. Question 9 of 17

   Which pair is an example of strong (two-factor) authentication?

   • AA password and a security question
   • BA password and a smart card badge
   • CA username and a password
   • DTwo different passwords
   Show answer

   Answer: B. A password and a smart card badge

   Strong authentication combines at least two categories: something you know, something you have, or something you are.

10. Question 10 of 17

    Why should laptops and USB sticks that hold personal data be encrypted?

    • ASo the device no longer needs software updates
    • BSo the data is unreadable if they are lost
    • CSo the data no longer counts as personal data
    • DSo the files take up less space on the device
    Show answer

    Answer: B. So the data is unreadable if they are lost

    Encrypted data is still personal data, but it cannot be read without the key. The EDPB notes that encryption could have prevented the risk when a laptop was stolen.

11. Question 11 of 17

    Where should you normally save work files that contain personal data?

    • AOn the organisation's backed-up network storage
    • BIn a free personal cloud account
    • COn a USB stick in your bag
    • DOn the desktop of your own computer
    Show answer

    Answer: A. On the organisation's backed-up network storage

    The EDPB recommends storing user data on regularly backed-up network storage rather than on workstations.

12. Question 12 of 17

    Working from home, a colleague suggests sending a customer list through a free personal chat app. What is the best response?

    • AUse the app if the list has fewer than 100 names
    • BUse the app, but delete the message after a week
    • CUse only the tools your organisation approves
    • DSend it by text message from your own phone instead
    Show answer

    Answer: C. Use only the tools your organisation approves

    The EDPB recommends approved collaboration tools and avoiding consumer software that shares user data with third parties.

13. Question 13 of 17

    A visitor in reception asks to walk to a meeting room in a staff-only area alone. What should happen?

    • AThey can borrow a staff badge to get in
    • BA member of staff should go with them
    • CThey can go alone if they seem trustworthy
    • DThey can go alone if the meeting is short
    Show answer

    Answer: B. A member of staff should go with them

    The EDPB recommends that visitors are accompanied outside public areas and that their arrival and departure are recorded.

14. Question 14 of 17

    You use your own phone for work email. Who is responsible for the security of the company data on it?

    • AOnly the company that made the phone
    • BYour employer, so follow its device rules
    • CNobody, because the phone is your private property
    • DOnly the mobile network that you use
    Show answer

    Answer: B. Your employer, so follow its device rules

    The EDPB says employers remain responsible for the security of company data on personal devices used for work.

15. Question 15 of 17

    Another department asks you for a copy of a customer list. What should you check first?

    • AThat they need it, and send only what is needed
    • BThat they promise to delete it within one year
    • CThat the list is sent to them as a printed copy
    • DThat their manager is more senior than yours
    Show answer

    Answer: A. That they need it, and send only what is needed

    Data should only reach people who need it for their role, and only what is necessary (need-to-know and data minimisation).

16. Question 16 of 17

    Read the email. What is the problem with how the addresses were entered?

    From: lena.fischer@harbourschool.example.com
    To: parent01@example.com; parent02@example.com; parent03@example.com; ... (38 addresses in total)
    Subject: School trip reminder
    Attachment: trip_list.xlsx (names of pupils, medical needs, parents' phone numbers)

    Dear parents, here is a reminder about Friday's trip. The full list is attached for your information. Kind regards, Lena

    • AThe email should have been sent from a personal account
    • BThe email cannot be delivered to so many addresses
    • CAll parents can see each other's addresses
    • DThe subject line of the email contains personal data
    Show answer

    Answer: C. All parents can see each other's addresses

    Putting external recipients in the To field reveals their addresses to each other. BCC should be used for group emails.

17. Question 17 of 17

    Read the email. What is the most serious problem with the attachment?

    From: lena.fischer@harbourschool.example.com
    To: parent01@example.com; parent02@example.com; parent03@example.com; ... (38 addresses in total)
    Subject: School trip reminder
    Attachment: trip_list.xlsx (names of pupils, medical needs, parents' phone numbers)

    Dear parents, here is a reminder about Friday's trip. The full list is attached for your information. Kind regards, Lena

    • AThe file name is too short to describe the school trip
    • BIt shares pupils' medical needs with all parents
    • CSome parents may not have the software to open the file
    • DThe file is a spreadsheet and not a PDF document
    Show answer

    Answer: B. It shares pupils' medical needs with all parents

    Medical needs are health data, a special category. Sharing them with all parents goes beyond need-to-know and would be a personal data breach.

Keyboard: 1–4 to answer, Enter for the next question.