Data Disclosure and Transfer CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company collects customer data for order processing. The company wants to share this data with a third-party loyalty program. The privacy policy states that data may be shared with 'affiliates for marketing purposes'. The loyalty program is operated by an affiliate. What is the company's obligation?

   • AEnsure that the loyalty program purpose is compatible with the original purpose and that the data shared is minimized
   • BNo obligation because the affiliate is part of the same corporate group
   • CObtain consent from each customer before sharing
   • DRely on the affiliate's privacy policy
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Under the GDPR, what must a controller do before transferring personal data to a third country that lacks an adequacy decision?

   • AAnonymize all personal data before transfer
   • BAppoint a representative in the destination country
   • CObtain a Data Protection Impact Assessment for every transfer
   • DEnsure appropriate safeguards are in place, such as SCCs or BCRs
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company transfers personal data from the EU to a processor in a country that has an adequacy decision. The processor then sub-processes the data to a third party in a non-adequate country. What is the company's responsibility?

   • ARely on the adequacy decision of the first country to cover all onward transfers
   • BNo responsibility because the processor is responsible for its own sub-processors
   • CEnsure the processor has a valid transfer mechanism for the onward transfer
   • DObtain consent from each data subject for the onward transfer
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational company transfers HR data from its EU entity to its US parent using SCCs. The US parent is subject to FISA surveillance. A data subject challenges the transfer. What is the MOST appropriate response?

   • AConduct a transfer impact assessment and implement supplementary measures if necessary
   • BStop all transfers to the US immediately
   • CObtain consent from each data subject for the transfer
   • DRely on the SCCs as sufficient because they are a valid transfer mechanism
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A US-based SaaS provider processes HR data for a European customer. The customer's employees are in the EU, and the provider's servers are in the US. The provider has no EU establishment. Which mechanism would BEST enable compliant data transfers under GDPR?

   • AObtain consent from each employee for the transfer
   • BImplement Standard Contractual Clauses (SCCs) with the customer as data exporter
   • CRely on the customer's adequacy decision for the US
   • DUse Binding Corporate Rules (BCRs) for the provider's internal transfers
   Reveal Solution Discussion Select an answer first