EXIN Privacy and Data Protection Foundation - PDPF Exam Practice Test

A controller wants to switch processors. What is necessary to review before making this change, so that it remains GDPR compliant?

What is the definition of Processor according to GDPR?

The Control Authority may impose fines on organizations that are not meeting the mandatory requirements of the General Data Protection Regulation (GDPR).

Your credit card has been cloned. A card contains various personal information.
What category of data breach is this incident?

The word privacy is never mentioned in the General Data Protection Regulation (GDPR) text.
Despite this, what would be the best definition of the privacy according to the Regulation?

Which option below defines correctly data protection by design (from conception)?

In its Article 9 the GDPR categorizes some types of personal data as "sensitive".
Of these below which are considered sensitive?

What is the legal status of the GDPR?

Article 33 of the GDPR deals with "Notification of a personal data breach to the supervisory authority".
Paragraph 3 sets out the minimum information that must be included in this notification. Which of the below is one of these?

A company CEO travels to a meeting in another city. He takes a notebook with information about the company's new projects and acquisitions, which will be the subject of discussion at this meeting. These are the only data stored on the notebook.
The notebook accidentally falls into the hotel's pool and all data is lost.
What happened, considering the General Data Protection Regulation (GDPR)?