GDPR

GDPR Advanced

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Deep GDPR scenarios covering joint controllership, international transfers, enforcement mechanics, and complex data subject rights.

16 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 16

Two organisations jointly determine the purposes and means of processing the same personal data. Under Article 26, what must they do?

Determine their respective responsibilities by means of an arrangement, in a transparent manner, with the essence made available to data subjectsMerge into a single legal entityAppoint a single organisation to bear 100% of all liabilityNothing — joint controllership has no formal requirements

Question 2 of 16

Following Schrems II, what did the CJEU require in addition to relying on Standard Contractual Clauses for a third-country transfer?

Approval from the destination country's governmentConversion of all personal data to anonymous data before transferNothing further — SCCs alone are always sufficientA case-by-case transfer impact assessment of the destination country's laws, with supplementary measures where needed

Question 3 of 16

Which of the following can constitute 'supplementary measures' to address a transfer impact assessment finding of risk?

Select all that apply.

Ignoring the finding and proceeding anywayStrong encryption with keys held outside the destination country's jurisdictionPseudonymisationContractual commitments to challenge government access requests

Question 4 of 16

Article 9 concerns 'special categories' of personal data. Which of the following is NOT listed as a special category?

Genetic dataData concerning healthData revealing racial or ethnic originAn individual's postal address

Question 5 of 16

Under Article 9(2), which is a recognised condition for processing special category data?

No condition is ever required for special category dataThe data was found publicly on social media, regardless of contextExplicit consent of the data subject, subject to Member State law restrictionsThe controller finds it commercially convenient

Question 6 of 16

The 'one-stop-shop' mechanism under GDPR allows a controller with cross-border processing to primarily deal with which supervisory authority?

The lead supervisory authority, based on the location of its main establishmentNo supervisory authority — cross-border processing is self-regulatedEvery supervisory authority in every Member State where data subjects are located, simultaneously and independentlyOnly the Irish Data Protection Commission, regardless of establishment

Question 7 of 16

Which of the following are among the criteria in Article 83(2) that supervisory authorities must consider when deciding whether to impose a fine and its amount?

Select all that apply.

Any previous infringements by the controllerThe degree of cooperation with the supervisory authority to remedy the infringementThe nature, gravity and duration of the infringementThe controller's stock price on the day of the decision

Question 8 of 16

Under Article 17 (right to erasure), which is a recognised ground for a controller to refuse an erasure request?

The controller simply does not want to complyProcessing is necessary for compliance with a legal obligation, or for the establishment, exercise or defence of legal claimsThe data subject is a minorThe request was submitted by email rather than post

Question 9 of 16

Article 20 (right to data portability) applies to personal data processed on which legal bases?

Legitimate interest onlyAny legal basis whatsoeverLegal obligation onlyConsent or contract, and where processing is carried out by automated means

Question 10 of 16

A Binding Corporate Rules (BCR) authorisation, once approved by a supervisory authority, covers intra-group transfers only and cannot be relied upon for transfers to external processors.

TrueFalse

Question 11 of 16

What is the general maximum period a supervisory authority has to respond to requests under the one-stop-shop cooperation and consistency mechanism before an 'urgency procedure' may apply?

There is no time pressure ever built into the mechanism72 hours in all cases without exception10 yearsThe regulation sets specific short deadlines (e.g. one month for opinions) precisely because delay itself can cause harm

Question 12 of 16

A controller relies on 'legitimate interests' under Article 6(1)(f). What must it be able to demonstrate?

Nothing — legitimate interest requires no documentationThat its interests are not overridden by the interests or fundamental rights and freedoms of the data subject, typically via a documented balancing testThat it obtained consent as well, making the balancing test redundantThat the data subject is an EU citizen

Question 13 of 16

Under Article 37, which organisation is generally required to designate a DPO regardless of size?

A public authority or body, except courts acting in their judicial capacityOnly companies headquartered outside the EUA small bakery with five employees and no special category processingAny company with a website

Question 14 of 16

Which of the following are valid grounds under Article 49 for a 'derogation' allowing an international transfer in the absence of an adequacy decision or appropriate safeguards?

Select all that apply.

The transfer is necessary for the performance of a contract between the data subject and controllerIt is simply more convenient for the controllerExplicit consent after being informed of the risksThe transfer is necessary for important reasons of public interest

Question 15 of 16

Article 82 gives data subjects a right to compensation for material or non-material damage. Who bears the burden of proving they are not responsible for the event giving rise to the damage?

The controller or processor, who is exempt only if it proves it is not in any way responsibleNo one — liability is strict with no exemptionThe supervisory authority decides fault administratively before any claim can proceedThe data subject must prove the controller/processor is at fault

Question 16 of 16

Pseudonymised data that can be re-identified using additional information held separately still falls within the scope of 'personal data' under the GDPR.

TrueFalse

0 of 16 answered