Question 1 of 10 · Introduction to European Data Protection
What does the Data Governance Act mainly regulate?
The DGA sets rules for reuse of protected public sector data, data intermediation services and data altruism. Connected device data is the Data Act, essential services NIS2, and content moderation the DSA.
Question 2 of 10 · European Data Protection Law and Regulation
If informing each affected data subject would involve disproportionate effort, what must the controller do?
Article 34(3)(c) requires a public communication or similar measure that informs data subjects equally effectively. Silence, delay or partial notice do not satisfy it.
Question 3 of 10 · European Data Processing
By how long may a controller extend the deadline for responding to a data subject request?
Article 12(3) allows extension by two further months, taking into account complexity and number, with the data subject told within the first month. The other options are wrong.
Question 4 of 10 · European Data Protection: Scope and Accountability
What does Article 32 require regarding the effectiveness of security measures?
Article 32(1)(d) includes a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures. Commission certification, publication and fixed replacement cycles are not required.
Question 5 of 10 · Compliance with European Data Protection Law and Regulation
What is the main data protection issue with bring-your-own-device schemes?
BYOD mixes personal and business data, requiring separation, security measures and limits on monitoring of personal content.
Question 6 of 10 · Introduction to European Data Protection
Which rule governs data processing by police and criminal justice authorities in the EU?
Directive 2016/680 covers processing by competent authorities for criminal law enforcement purposes, which falls outside the GDPR under Article 2(2)(d).
Question 7 of 10 · European Data Protection Law and Regulation
Which statement about onward transfers under an adequacy decision is accurate?
Article 44 requires that the level of protection is not undermined by onward transfers, so adequacy assessments look at how the third country handles onward transfers and protections must follow the data. Onward transfers remain regulated, they are not banned under adequacy decisions, and they are not left to the importer's national law alone.
Question 8 of 10 · European Data Processing
Which right applies when processing is restricted?
Under Article 18, restricted data may only be stored, and otherwise processed only with consent, for legal claims, to protect others' rights or for important public interest. Deletion, sale and sending to authorities are wrong.
Question 9 of 10 · European Data Protection: Scope and Accountability
A company in the US offers goods to consumers in France through a French-language website priced in euros, with no EU establishment. Does the GDPR apply?
Article 3(2)(a) applies the GDPR to controllers outside the EU that offer goods or services to data subjects in the Union. Language, currency and delivery indicate targeting.
Question 10 of 10 · Compliance with European Data Protection Law and Regulation
An employer wants to screen job applicants' social media. What is the key requirement?
EDPB guidance holds that publicly available data is still personal data; employers need a legal basis, necessity for the role and transparency.
0 of 10
Introduction to European Data Protection
European Data Protection Law and Regulation
European Data Processing
European Data Protection: Scope and Accountability
Compliance with European Data Protection Law and Regulation
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.