A company transfers personal data from the EU to a processor in a country with an adequacy decision. The processor then transfers the data to a sub-processor in a non-adequate country. The company's contract with the processor does not address sub-processing. What is the company's BEST course of action?

Rely on the processor's adequacy decision to cover the sub-processor

Notify the DPA of the sub-processing arrangement

Terminate the contract with the processor immediately

Amend the contract to require the processor to obtain prior written authorization for sub-processing and ensure a valid transfer mechanism for onward transfers

A company detects that a third-party vendor has experienced a data breach that may have exposed personal data the company shared with the vendor. The vendor is in a country with an adequacy decision. What is the company's obligation?

Terminate the contract with the vendor immediately

Notify all data subjects immediately

No obligation because the vendor is responsible for the breach

Assess the risk to data subjects and notify the DPA if required

Under the GDPR, when a data subject objects to the processing of their personal data for direct marketing, what must the controller do?

Stop processing the data for direct marketing purposes

Transfer the data to a third country to avoid the objection

Conduct a balancing test to decide if the objection is valid

Certified Data Privacy Solutions Engineer

Domain 3Objective 6

Data Disclosure and Transfer CDPSE Practice Questions (Page 4)

Part of the Data Life Cycle Management domain, which accounts for 23% of the CDPSE exam.

26questions here

6free pages

6concepts

23%of the exam

Questions 16–20

16expert · hard
A company transfers personal data from the EU to a processor in a country with an adequacy decision. The processor then transfers the data to a sub-processor in a non-adequate country. The company's contract with the processor does not address sub-processing. What is the company's BEST course of action?
Select an answer first
17application · medium
A company detects that a third-party vendor has experienced a data breach that may have exposed personal data the company shared with the vendor. The vendor is in a country with an adequacy decision. What is the company's obligation?
Select an answer first
18foundation · easy
A data subject requests a copy of all personal data that a company has disclosed to third parties. Which data subject right does this request most directly exercise?
Select an answer first
19foundation · easy
Under the GDPR, when a data subject objects to the processing of their personal data for direct marketing, what must the controller do?
Select an answer first
20foundation · easy
Which principle requires that personal data collected for one purpose not be used for an unrelated purpose without a lawful basis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CDPSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CDPSE” is a trademark of its owner, used for identification only.

Data Disclosure and Transfer CDPSE Practice Questions (Page 4)

Questions 16–20

A company detects that a third-party vendor has experienced a data breach that may have exposed personal data the company shared with the vendor. The vendor is in a country with an adequacy decision. What is the company's obligation?

A data subject requests a copy of all personal data that a company has disclosed to third parties. Which data subject right does this request most directly exercise?

Under the GDPR, when a data subject objects to the processing of their personal data for direct marketing, what must the controller do?

Which principle requires that personal data collected for one purpose not be used for an unrelated purpose without a lawful basis?

Keep studying — Data Life Cycle Management