GDPR

GDPR Practitioner

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Applying GDPR in practice: transparency notices, automated decision-making, design obligations, and cross-border transfers.

14 questions · 75% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 14

Article 5's accountability principle requires controllers to be able to demonstrate compliance with the other principles, not just comply with them.

TrueFalse

Question 2 of 14

Under Article 13, when personal data is collected directly from the data subject, at what point must the required privacy information generally be provided?

Within 30 days of collectionAt the time the personal data is obtainedOnly when the data is later shared with a third partyOnly if the data subject asks for it

Question 3 of 14

Article 14 (data not obtained from the data subject) generally requires providing privacy information within what timeframe?

Within 72 hours, mirroring the breach notification deadlineOnly upon a subject access requestA reasonable period, at the latest within one month, or at first communication/disclosure if earlierImmediately, with no exceptions

Question 4 of 14

Which of the following are among the six data protection principles listed in Article 5(1)?

Select all that apply.

Question 5 of 14

Article 22 gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, that produces what kind of effect?

Only effects related to employmentOnly effects that are financially beneficialLegal effects concerning them or similarly significant effectsAny effect whatsoever, however trivial

Question 6 of 14

Which is a recognised exception allowing solely automated decision-making under Article 22(2)?

The controller simply prefers automationIt is necessary for entering into or performing a contract between the data subject and controllerThe decision is made outside the EUThe data subject is unaware it is happening

Question 7 of 14

Article 25 ('data protection by design and by default') requires controllers to implement appropriate technical and organisational measures at what stage?

Only when requested by a supervisory authorityOnly after a data breach has occurredOnly during an external auditAt the time of determining the means of processing and at the time of the processing itself

Question 8 of 14

What does 'data protection by default' specifically require?

Ensuring that, by default, only personal data necessary for each specific purpose is processedRequiring users to opt out of privacy protectionsPublishing all data collected by defaultCollecting the maximum data possible by default

Question 9 of 14

Under Article 35, who must be consulted when carrying out a DPIA, where relevant?

The views of data subjects or their representatives, where appropriateNo one — DPIAs are conducted in total isolationOnly the company's marketing teamA competing organisation

Question 10 of 14

Which of the following are legitimate grounds under Chapter V for transferring personal data outside the EEA?

Select all that apply.

Binding Corporate Rules (BCRs) for intra-group transfersSimply informing the data subject after the fact with no other safeguardStandard Contractual Clauses (SCCs)An adequacy decision by the European Commission

Question 11 of 14

Article 33 requires notifying the supervisory authority of a breach 'without undue delay and, where feasible, not later than 72 hours after having become aware of it' — what happens if notification is not made within 72 hours?

The controller can never notify lateThe notification must be accompanied by reasons for the delayNo notification is required after 72 hoursThe fine is automatically doubled

Question 12 of 14

Article 83 sets a two-tier system of administrative fines. Which infringement category attracts the higher tier (up to EUR 20 million / 4% of turnover)?

Record-keeping obligations under Article 30Minor administrative paperwork errors onlyLate responses to marketing emailsInfringements of the basic principles for processing, including conditions for consent, and data subject rights

Question 13 of 14

Which role is responsible for determining the purposes and means of processing personal data?

The processorThe supervisory authorityThe data subjectThe controller

Question 14 of 14

A processor may engage another processor (a sub-processor) without any authorisation from the controller.

TrueFalse

0 of 14 answered