GDPR for Employees Course (EU) 2026

1. 第1题，共16题

   What does the abbreviation GDPR stand for?

   • AGeneral Data Protection Regulation
   • BGlobal Data Privacy and Records Rules
   • CGuide to Data Processing Rights
   • DGeneral Directive on Personal Records
   显示答案

   答案: A. General Data Protection Regulation

   GDPR is the General Data Protection Regulation, Regulation (EU) 2016/679.

2. 第2题，共16题

   Since which date has the GDPR applied across the EU?

   • A25 May 2018
   • B1 January 2020
   • C24 May 2016
   • D25 May 2016
   显示答案

   答案: A. 25 May 2018

   The GDPR entered into force on 24 May 2016 and has applied since 25 May 2018.

3. 第3题，共16题

   Under the GDPR, personal data is information that relates to whom?

   • AOnly people who have signed a contract with you
   • BAny company, charity or other organisation
   • COnly people who are citizens of an EU country
   • DAn identified or identifiable living person
   显示答案

   答案: D. An identified or identifiable living person

   Personal data is any information relating to an identified or identifiable living individual, called the data subject.

4. 第4题，共16题

   Which of these is personal data?

   • AA company's official registration number
   • BA shared company mailbox such as info@example.com
   • CThe work email marta.novak@example.com
   • DRegional sales totals that were fully anonymised
   显示答案

   答案: C. The work email marta.novak@example.com

   An email address that points to one person is personal data. Company numbers, generic company addresses and irreversibly anonymised data are not.

5. 第5题，共16题

   What is the person that personal data is about called?

   • AThe data processor
   • BThe data recipient
   • CThe data controller
   • DThe data subject
   显示答案

   答案: D. The data subject

   Article 4(1) GDPR calls the identified or identifiable person the data subject.

6. 第6题，共16题

   Which of these belongs to the special categories of personal data?

   • AA person's direct work phone number
   • BA person's start date with the company
   • CData about a person's health
   • DA person's job title and department
   显示答案

   答案: C. Data about a person's health

   Health data is one of the special categories in Article 9 GDPR, which need extra protection.

7. 第7题，共16题

   Which statement best describes "processing" under the GDPR?

   • AOnly changing personal data in some way after it has first been collected
   • BOnly storing personal data on a computer system for longer than one month
   • CAny operation on personal data, from collecting and viewing it to deleting it
   • DOnly sending personal data to people outside the organisation that collected it
   显示答案

   答案: C. Any operation on personal data, from collecting and viewing it to deleting it

   Article 4(2) GDPR defines processing very widely, from collection and consultation to disclosure, erasure and destruction.

8. 第8题，共16题

   In a staff survey, names are replaced with codes and the list linking codes to names is kept separately. What is the survey data now?

   • ASpecial category data in every case
   • BPersonal data only if it is published
   • CAnonymous data that is outside the GDPR
   • DStill personal data, as it can be linked back to people
   显示答案

   答案: D. Still personal data, as it can be linked back to people

   Pseudonymised data can be used to re-identify people, so it remains personal data under the GDPR.

9. 第9题，共16题

   When does information stop being personal data?

   • AWhen it is stored in a locked filing cabinet
   • BWhen it is encrypted with a strong password
   • CWhen names are swapped for reference numbers
   • DWhen it is anonymised so that nobody can ever be identified again
   显示答案

   答案: D. When it is anonymised so that nobody can ever be identified again

   Only data anonymised so that no one can be identified, irreversibly, falls outside the GDPR. Encrypted and pseudonymised data are still personal data.

10. 第10题，共16题

    What is the organisation that decides why and how personal data is processed called?

    • AThe processor
    • BThe data subject
    • CThe supervisory authority
    • DThe controller
    显示答案

    答案: D. The controller

    Article 4(7) GDPR: the controller determines the purposes and means of the processing.

11. 第11题，共16题

    A company uses an outside payroll provider, which pays staff on the company's instructions. What is the payroll provider usually?

    • AA processor
    • BThe controller
    • CA supervisory authority
    • DA data subject
    显示答案

    答案: A. A processor

    A processor processes personal data on behalf of the controller. The EDPB gives a payroll company as an example.

12. 第12题，共16题

    Who enforces the GDPR in each EU country?

    • AAn independent national data protection authority
    • BThe European Commission in every case
    • CThe national tax office
    • DEach organisation's own data protection officer
    显示答案

    答案: A. An independent national data protection authority

    Each EEA country has its own independent data protection authority, which handles complaints, investigates and can impose sanctions.

13. 第13题，共16题

    Pavel keeps an address book of his friends' birthdays at home, just for himself. Does the GDPR apply to it?

    • ANo, purely personal or household activities are outside it
    • BYes, the GDPR covers all personal data kept anywhere in the EU
    • CYes, because a date of birth is a special category of data
    • DOnly if the address book has more than 50 entries in it
    显示答案

    答案: A. No, purely personal or household activities are outside it

    Article 2(2)(c) GDPR excludes processing by a person in a purely personal or household activity. Data you handle at work is not covered by this exception.

14. 第14题，共16题

    According to the GDPR recitals, which can set more specific rules on processing employees' personal data?

    • AOnly guidance from trade associations
    • BNational law or collective agreements, such as works agreements
    • COnly each employer's privacy notice
    • DOnly each worker's employment contract
    显示答案

    答案: B. National law or collective agreements, such as works agreements

    Recital 155 says Member State law or collective agreements, including works agreements, may set specific rules for employee data. National rules therefore differ.

15. 第15题，共16题

    Read the description. What kind of data is in column D?

    Clara works at the front desk of Northfield Clinic. Her manager asks her to tidy up a spreadsheet called "visits.xlsx". It has these columns:

    Column A: patient code (for example P-1047)
    Column B: first name
    Column C: date of visit
    Column D: reason for visit (for example "asthma check")
    Column E: email address (for example j.doe@example.com)

    • AOrdinary personal data that needs no extra protection
    • BSpecial category data, because it concerns health
    • CData about criminal convictions and offences
    • DNot personal data, because no name is in that column
    显示答案

    答案: B. Special category data, because it concerns health

    The reason for a clinic visit, such as an asthma check, is data concerning health, a special category under Article 9 GDPR.

16. 第16题，共16题

    Read the description. Clara suggests deleting column B so the file is "anonymous". Is she right?

    Clara works at the front desk of Northfield Clinic. Her manager asks her to tidy up a spreadsheet called "visits.xlsx". It has these columns:

    Column A: patient code (for example P-1047)
    Column B: first name
    Column C: date of visit
    Column D: reason for visit (for example "asthma check")
    Column E: email address (for example j.doe@example.com)

    • ANo, because clinics are never allowed to delete any data
    • BYes, as long as the file is also given a new name
    • CYes, without first names nobody at all can be identified
    • DNo, the codes and email addresses still identify people
    显示答案

    答案: D. No, the codes and email addresses still identify people

    Data is only anonymous if no one can be identified. Codes that link to patient records and email addresses still identify people, so it stays personal data.

键盘：按1–4作答，按 Enter 进入下一题。