GDPR for Employees Course (EU)：Everyday safeguards at work

1. 第1题，共17题

   As an employee, when may you use personal data that your employer holds?

   • AFor your own purposes, if you delete it afterwards
   • BOnly for the tasks you are instructed to do
   • CWhenever a friend or relative asks you politely
   • DWhenever you have system access to that data
   显示答案

   答案: B. Only for the tasks you are instructed to do

   Article 29 GDPR: anyone acting under the authority of the controller may process personal data only on the controller's instructions.

2. 第2题，共17题

   A well-known person is a customer. A colleague opens their record just out of curiosity. Is that acceptable?

   • ANo, viewing it is processing outside their job
   • BYes, because only looking at data is not processing
   • CYes, if the record does not include any health data
   • DYes, as long as the colleague does not tell anyone
   显示答案

   答案: A. No, viewing it is processing outside their job

   Consultation (looking up) is processing under Article 4(2), and staff may only process data on the controller's instructions.

3. 第3题，共17题

   What does "need-to-know" access mean?

   • AEveryone can see all data but must ask before changing it
   • BManagers can always see every record their team can see
   • CData is shared with anyone in the company who asks for it
   • DPeople can open only the data their role needs
   显示答案

   答案: D. People can open only the data their role needs

   The EDPB recommends granting access on a need-to-know basis with different access profiles.

4. 第4题，共17题

   A colleague asks to use your login to save time while theirs is being set up. What should you do?

   • AWrite your password on a sticky note for them
   • BRefuse: everyone needs their own account
   • CAgree, and change your password afterwards
   • DAgree, as long as they only use it for one day
   显示答案

   答案: B. Refuse: everyone needs their own account

   The EDPB recommends a unique identifier for each user and no shared accounts.

5. 第5题，共17题

   You leave your desk to get a coffee. What should you do with your computer?

   • ATurn the monitor brightness down
   • BClose only the email program
   • CLock the screen before you walk away
   • DLeave it, as the screen locks itself later
   显示答案

   答案: C. Lock the screen before you walk away

   The EDPB lists locking your screen while you are away as a basic measure. An automatic lock only starts after some time, so lock it yourself.

6. 第6题，共17题

   At the end of the day, what should you do with paper files that contain personal data?

   • ATurn them face down on the desk
   • BTake them home to finish them later
   • CLock them in a drawer or cabinet
   • DLeave them in a neat pile on the desk
   显示答案

   答案: C. Lock them in a drawer or cabinet

   Paper records need protection too. The EDPB recommends a clean desk policy and keeping documents in a locked drawer or room.

7. 第7题，共17题

   You must email the same notice to 40 external customers. How should you add their addresses?

   • AIn the To field, so everyone sees who got it
   • BIn the CC field, so replies go to everyone
   • CIn the subject line, so it is easy to sort
   • DIn the BCC field, so the addresses stay hidden
   显示答案

   答案: D. In the BCC field, so the addresses stay hidden

   The EDPB recommends putting multiple recipients in BCC by default so customers cannot see each other's addresses.

8. 第8题，共17题

   Your email program fills in addresses automatically. Why should you check the recipient before sending?

   • AIt always sends a hidden copy to the IT team
   • BIt turns off encryption for that email
   • CIt removes any attachment that is very large
   • DIt may pick the wrong person with a similar name
   显示答案

   答案: D. It may pick the wrong person with a similar name

   Sending to the wrong recipient is a common breach. The EDPB suggests checks such as disabling autocomplete and confirming recipients.

9. 第9题，共17题

   Which pair is an example of strong (two-factor) authentication?

   • AA password and a security question
   • BA password and a smart card badge
   • CA username and a password
   • DTwo different passwords
   显示答案

   答案: B. A password and a smart card badge

   Strong authentication combines at least two categories: something you know, something you have, or something you are.

10. 第10题，共17题

    Why should laptops and USB sticks that hold personal data be encrypted?

    • ASo the device no longer needs software updates
    • BSo the data is unreadable if they are lost
    • CSo the data no longer counts as personal data
    • DSo the files take up less space on the device
    显示答案

    答案: B. So the data is unreadable if they are lost

    Encrypted data is still personal data, but it cannot be read without the key. The EDPB notes that encryption could have prevented the risk when a laptop was stolen.

11. 第11题，共17题

    Where should you normally save work files that contain personal data?

    • AOn the organisation's backed-up network storage
    • BIn a free personal cloud account
    • COn a USB stick in your bag
    • DOn the desktop of your own computer
    显示答案

    答案: A. On the organisation's backed-up network storage

    The EDPB recommends storing user data on regularly backed-up network storage rather than on workstations.

12. 第12题，共17题

    Working from home, a colleague suggests sending a customer list through a free personal chat app. What is the best response?

    • AUse the app if the list has fewer than 100 names
    • BUse the app, but delete the message after a week
    • CUse only the tools your organisation approves
    • DSend it by text message from your own phone instead
    显示答案

    答案: C. Use only the tools your organisation approves

    The EDPB recommends approved collaboration tools and avoiding consumer software that shares user data with third parties.

13. 第13题，共17题

    A visitor in reception asks to walk to a meeting room in a staff-only area alone. What should happen?

    • AThey can borrow a staff badge to get in
    • BA member of staff should go with them
    • CThey can go alone if they seem trustworthy
    • DThey can go alone if the meeting is short
    显示答案

    答案: B. A member of staff should go with them

    The EDPB recommends that visitors are accompanied outside public areas and that their arrival and departure are recorded.

14. 第14题，共17题

    You use your own phone for work email. Who is responsible for the security of the company data on it?

    • AOnly the company that made the phone
    • BYour employer, so follow its device rules
    • CNobody, because the phone is your private property
    • DOnly the mobile network that you use
    显示答案

    答案: B. Your employer, so follow its device rules

    The EDPB says employers remain responsible for the security of company data on personal devices used for work.

15. 第15题，共17题

    Another department asks you for a copy of a customer list. What should you check first?

    • AThat they need it, and send only what is needed
    • BThat they promise to delete it within one year
    • CThat the list is sent to them as a printed copy
    • DThat their manager is more senior than yours
    显示答案

    答案: A. That they need it, and send only what is needed

    Data should only reach people who need it for their role, and only what is necessary (need-to-know and data minimisation).

16. 第16题，共17题

    Read the email. What is the problem with how the addresses were entered?

    From: lena.fischer@harbourschool.example.com
    To: parent01@example.com; parent02@example.com; parent03@example.com; ... (38 addresses in total)
    Subject: School trip reminder
    Attachment: trip_list.xlsx (names of pupils, medical needs, parents' phone numbers)

    Dear parents, here is a reminder about Friday's trip. The full list is attached for your information. Kind regards, Lena

    • AThe email should have been sent from a personal account
    • BThe email cannot be delivered to so many addresses
    • CAll parents can see each other's addresses
    • DThe subject line of the email contains personal data
    显示答案

    答案: C. All parents can see each other's addresses

    Putting external recipients in the To field reveals their addresses to each other. BCC should be used for group emails.

17. 第17题，共17题

    Read the email. What is the most serious problem with the attachment?

    From: lena.fischer@harbourschool.example.com
    To: parent01@example.com; parent02@example.com; parent03@example.com; ... (38 addresses in total)
    Subject: School trip reminder
    Attachment: trip_list.xlsx (names of pupils, medical needs, parents' phone numbers)

    Dear parents, here is a reminder about Friday's trip. The full list is attached for your information. Kind regards, Lena

    • AThe file name is too short to describe the school trip
    • BIt shares pupils' medical needs with all parents
    • CSome parents may not have the software to open the file
    • DThe file is a spreadsheet and not a PDF document
    显示答案

    答案: B. It shares pupils' medical needs with all parents

    Medical needs are health data, a special category. Sharing them with all parents goes beyond need-to-know and would be a personal data breach.

键盘：按1–4作答，按 Enter 进入下一题。