Curious about Actual PECB Certified Data Protection Officer Exam Questions?

Correct : A

Under Article 9(2)(f) of GDPR, the processing of special categories of data (e.g., health data) is permitted without consent if it is necessary for the establishment, exercise, or defense of legal claims.

Option A is correct because GDPR allows processing of special category data for legal claims, even without explicit consent.

Option B is incorrect because processing for legal claims is not restricted to public health institutions.

Option C is incorrect because GDPR explicitly allows such processing for legal claims.

Option D is incorrect because anonymization is not required when data is processed under Article 9(2)(f).

GDPR Article 9(2)(f) (Processing of special categories of data for legal claims)

Recital 52 (Legal grounds for processing sensitive data in court cases)

Correct : D

Under Article 15(1)(c) of GDPR, data subjects have the right to access information about the recipients or categories of recipients who have received their personal data.

Option D is correct because GDPR mandates transparency regarding data sharing.

Option A is incorrect because authorization from recipients is not required before disclosing their categories.

Option B is incorrect because identity verification applies to access requests but is not a prerequisite for providing recipient information.

Option C is incorrect because denying access to this information violates the data subject's right under GDPR.

GDPR Article 15(1)(c) (Right of access to recipient categories)

Recital 63 (Transparency in processing and access rights)

Correct : C

Under Article 39(1)(b) of GDPR, the DPO monitors compliance with GDPR and other applicable laws, including Member State laws on criminal conviction data.

Option C is correct because DPOs must ensure processing aligns with national legal requirements.

Option A is incorrect because determining processing locations is a technical decision, not a DPO responsibility.

Option B is incorrect because DPOs do not assess the necessity of identity disclosure.

Option D is incorrect because approving security measures is the responsibility of controllers and processors, not the DPO.

GDPR Article 39(1)(b) (DPO's role in ensuring legal compliance)

Recital 97 (DPO responsibilities in public and private sectors)

Correct : B

GDPR Article 6(1)(b) (Processing necessary for contract performance)

Recital 44 (Contractual necessity as a legal basis)

Correct : A

Under Article 39(1)(a) of GDPR, the DPO is responsible for monitoring GDPR compliance, including ensuring transparency in communication with data subjects. This includes verifying that information about data processing is accurate and relevant.

Option A is correct because GDPR mandates that data subjects receive clear and accurate information about their personal data processing.

Option B is incorrect because accuracy and relevance are key indicators of effective communication under GDPR.

Option C is incorrect because evaluating data protection communication is part of the DPO's compliance role.

Option D is incorrect because supervisory authority approval is not required for the DPO to conduct such evaluations.

GDPR Article 39(1)(a) (DPO's role in monitoring compliance)

GDPR Article 12(1) (Obligation for transparent and clear communication)