Data Disclosure and Transfer CDPSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A data subject requests that their personal data not be transferred to a third-party vendor for direct marketing. The company has a legitimate interest basis for the transfer. The vendor is in a country with an adequacy decision. What is the company's obligation?

   • ATransfer the data but allow the data subject to opt out later
   • BContinue the transfer because the company has a legitimate interest
   • CStop the transfer unless the company demonstrates compelling legitimate grounds that override the data subject's interests
   • DStop the transfer because the right to object to direct marketing is absolute
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company discovers that an employee accidentally emailed a spreadsheet containing customer personal data to an unauthorized external recipient. The email was sent from a corporate account. What is the FIRST step the company should take in its incident response?

   • AContain the incident by requesting the recipient delete the email and confirming deletion
   • BImmediately notify all affected data subjects
   • CNotify the data protection authority (DPA) within 72 hours
   • DConduct a full forensic investigation before taking any action
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which cross-border data transfer mechanism is a set of internal rules adopted by a multinational corporation to govern transfers of personal data among its own entities?

   • AData Protection Impact Assessment (DPIA)
   • BStandard Contractual Clauses (SCCs)
   • CAdequacy decision
   • DBinding Corporate Rules (BCRs)
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A marketing team asks for a full customer database to run a one-time promotional campaign. Which data protection principle most directly argues against providing the entire database?

   • ATransparency
   • BData minimization
   • CAccuracy
   • DIntegrity and confidentiality
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company shares customer data with a third-party analytics vendor. The vendor is in a country with an adequacy decision. The vendor's contract includes a clause that allows the vendor to use the data for its own product improvement. The company's privacy policy does not mention this. What is the company's risk?

   • AThe vendor's use for its own purposes may be incompatible with the original purpose and may require a separate lawful basis
   • BNo risk because the contract allows the vendor to use the data
   • CThe company must notify the DPA of the vendor's use
   • DNo risk because the vendor is in an adequate country
   Reveal Solution Discussion Select an answer first