Free EXIN PDPF Exam Dumps Questions & Answers

The Supervisory Authority is notified whenever an organization intends to process personal data, except for some specific situations. The Supervisory Authority keeps a publicly accessible register of these data processing operations.
What else is a legal obligation of the Supervisory Authority in reaction to such a notification?

• A.To assess compliance with the law in all classes where sensitive personal data is processed
• B.To assess the legitimacy of binding contract(s) between the controller and the data processor(s)
• C.To give out a license for the data processing, specifying the types of personal data which are allowed
• D.To assess the legitimacy of operations that involve specific risks for the data subjects

The General Data Protection Regulation (GDPR) allows processing of personal data only for purposes explicitly permitted by law. A tax advisor wants to file income tax returns for a neighbor.
Which of the legitimate grounds in the GDPR applies?

• A.Processing of the personal data is permitted in this case with explicit consent of the data subject.
• B.Processing of personal data is permitted in the course of a purely personal or household activity.
• C.Processing of the personal data is permitted because this is necessary for compliance with a legal obligation to which the controller is subject.

What should be done by the EU member states and is not a responsibility of the supervisory authorities?

• A.Make rules for penalizing other GDPR infringements
• B.Receive and process data breach notifications from controllers
• C.Order the controller to notify the data subject about a breach
• D.Impose administrative fines to controllers

While performing a backup, a data server disk crashed. Both the data and the backup are lost. The disk contained personal data, but no special category personal dat a. The processor states that this is a personal data breach. Is the statement of the processor true?

• A.Yes, because there were no special category personal data stored on the disk.
• B.Yes, because the personal data on the disk were unlawfully processed.
• C.No, because this is only a security incident and not a data breach
• D.No, because no personal data on the disk were processed, only destroyed

A secretary at a pediatric cardiology clinic instead of sending the doctor the list of patients scheduled for the day, sends it to all those responsible registered for the children with scheduled appointments.
According to the GDPR, does the Supervisory Authority need to be notified? And those responsible for the data holders?

• A.There is no need to notify the Supervisory Authority or those responsible for the data subjects, as whoever had access to the data is also someone in the same situation.
• B.The Supervisory Authority must be notified and also those responsible for the holders who had their data exposed.
• C.The Supervisory Authority must be notified, but there is no need to notify those responsible for the data subjects, as whoever had access to the data is also someone in the same situation.
• D.There is no need to notify the Supervisory Authority, however those responsible for the holders who had their data exposed must be notified.