Data Disclosure and Transfer CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a compliance requirement for cross-border data transfers under the GDPR?

   • ADocumenting the transfer mechanism and providing safeguards for data subjects
   • BPerforming a transfer impact assessment only if the destination is in the US
   • CStoring all transferred data in encrypted form at all times
   • DObtaining consent from every data subject before any transfer
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is an appropriate safeguard to implement before disclosing personal data to a third-party processor?

   • ATransfer all data to the vendor's cloud without review
   • BSign a data processing agreement that defines the scope and purpose of processing
   • CObtain verbal assurance from the vendor's sales representative
   • DRely solely on the vendor's privacy policy
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A data subject requests access to all personal data that a company has transferred to a third-party marketing vendor. The company has a data mapping exercise that shows the vendor received the data. What is the company's obligation under GDPR?

   • AForward the request to the vendor and let the vendor respond directly
   • BProvide only the data that remains in the company's own systems
   • CProvide the data subject with a copy of the personal data transferred and information about the recipients
   • DDeny the request because the data is now under the vendor's control
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is considering sharing customer data with a third-party research organization. The research organization is in a country with an adequacy decision. The company's privacy policy states that data may be shared for 'research purposes'. What is the MOST important factor to consider before sharing?

   • AWhether the research organization is located in a country with an adequacy decision
   • BWhether the research purpose is compatible with the original purpose and whether data minimization is applied
   • CWhether the research organization has a privacy policy
   • DWhether the research organization is a non-profit
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the first step an organization should take when it detects an unauthorized disclosure of personal data?

   • ANotify all data subjects immediately
   • BDelete all logs related to the incident
   • CIgnore the incident if no financial loss occurred
   • DContain the incident to prevent further data loss
   Reveal Solution Discussion Select an answer first