PDP9 Exam Questions Get Updated [2024] with Correct Answers [Q11-Q34]

4/5 - (1 vote)

PDP9 Exam Questions Get Updated [2024] with Correct Answers

Practice PDP9 Questions With Certification guide Q&A from Training Expert ValidBraindumps

The PDP9 certification program covers a wide range of topics related to data protection and privacy, including GDPR, data protection principles, confidentiality, privacy impact assessments, and much more. PDP9 course material is delivered through classroom training, online learning resources, and self-study materials. Candidates for the PDP9 exam are required to have a working knowledge of data protection principles and practices, and they must demonstrate their understanding of relevant legislation, regulations and best practices in the field of data protection.

Q11. Which of the following is NOT a role of the Information Commissioner’s Office?

Publishing a list of the kind of processing that is subject to the requirement for a DPIA

Providing an annual activity report to Parliament

Providing case by case advice on what retention period companies should use

Encouraging the establishment of data protection certification mechanisms and of data protection seals

Q12. Under the Privacy and Electronic Communications Regulations, organisations must NOT make marketing telephone calls to which of the following?

Any person under the age of 18, unless their parent or guardian has provided permission

Any person who is registered with the Telephone Preference Service, unless they have given specific consent to receive your calls

Any person who has not consented to receiving marketing calls

Any person outside of the United Kingdom.

Q13. What does NOT have an exemption prescribed under schedule 3 of the Data Protection Act 2018?

Social Work Data.

Credit checking agency data

Education data, examination scripts and marks

Health data

Q14. Article 57 of the UK GDPR states that the tasks of the Commissioner include -Select the INCORRECT answer

Handling complaints raised by individuals/data subjects

Providing general guidance to clarify the law.

Adopting consistency findings in cross-border data protection cases

Advising UK Parliament on issues related to the protection of personal data

Q15. A company has twenty retail outlets in France and thirty retail outlets in Belgium The payroll department and the Data Protection Officer are based in Poland.The Company Board and administrative functions are based in Germany. Determine where the company’s ‘mainestablishment’ would be

Belgium

France

Germany

Poland

Q16. An individual applies for a job as a security guard The employer has had significant issues with the sickness record of past recruits They therefore decide to offer the position to the individual on the basis they request a copy of their medical record so that the employer can be assured that they are in a good state of health.
The Data Protection Officer has been asked to advise. What advice is MOST appropriate?

Providing the medical evidence is used for a legitimate purpose, and that the information is securely destroyed on verification that the employee is healthy, this is an acceptable action.

While requesting and viewing medical evidence may be legitimate, they should ask for evidence that the individual consents to the proposition that they make the request

In requesting information that is more than they necessary require to verify the medical condition of the individual they will have breached the data minimisation principle

This is a criminal offence under the Data Protection Act 2018 No individual should be asked to make a subject access request in order to obtain health records in these circumstances.

Q17. Article 9(2)(c) of UK GDPR condition of processing special category data in the vital interests of the data subject is only applicable in which of the following circumstances:

When another lawful basis applies.

When a data subject is incapacitated

When the data subject is physically unable to be present

When the data subject refuses to consent

Q18. What does NOT have an exemption prescribed under schedule 3 of the Data Protection Act 2018?

Education data, examination scripts and marks

Credit checking agency data

Social Work Data.

Health data

Q19. What are Information Society Services’? Select the INCORRECT answer

A service provided for remuneration, by electronic means, at distance to an individual that has requested it.

An electronic information service provided to individuals but paid for solely by advertising

Business to business online networking sites

Information services provided by non-profit or government organisations with no remuneration

Q20. What is the meaning of storage limitation in relation to UK GDPR Article 5 (1 )(e)?

Keeping identifiable personal data for no longer than is necessary for the intended processing

Storing data in a secure format only permitting access to those with a business need

Only storing data in locations within the EU. except where there is an adequacy decision.

Limiting the number of records stored in any single repository to minimise risk surface.

Q21. Describe the act of processing under the authority of a controller or processor as stipulated in UK GDPR Article 29.

The processor shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.

A processor shall not process those data except on instructions from the controller, unless required to do so by domestic law

Each processor and, where applicable, the processors representative shall maintain a record of all categories of processing activities earned out on behalf of a controller.

The processor shall consult the supervisory authority prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the processor to mitigate the risk.

Q22. Which of the following statements MOST accurately describes why a risk-based approach to the use of Al is necessary?

Al is inherently negative and its use should be limited

Al is unlawful

Al’s benefits make accepting all arising risks necessary.

Al carries new and complex risks not present in other technologies

Q23. Which of the following statements are CORRECT about records of processing’?
A It must contain contact details for the Data Protection Officer where applicable.
B It must be submitted to the Information Commissioner’s Office following every Data Protection ImpactAssessment C It is mandatory for all data processors D The controller or the processor a mustmakesthe record available to the supervisory authority on request
E. It must contain contact details for the supervisory authority

B, C. and D

A,C,andE

A. C,D, and E

A, C,andD

Q24. If a complainant disagrees with the decision of the UK’s supervisory authority, how do they appeal this decision?

To the First Tier Tribunal (Information Rights)

To the Information Commissioner

To the European Data Protection Supervisor.

To the European Commission

Q25. Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?

It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO

It is key to the accountability element of the GDPR.

It fulfils a requirement that data protection is carried out by design and default.

It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated

Q26. Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?

It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated

It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO

It fulfils a requirement that data protection is carried out by design and default.

It is key to the accountability element of the GDPR.

Q27. Two businesses decide to work together to sell their products by mail order Orders are made via a single online website and they each use their existing employees to administer and update each other’s orders on a single order system regardless of product.
Which of the below is CORRECT of the roles of the two businesses in relation to the single order system’?

They are controllers of their own information contained in the single order system only

They are controllers of their own information in the single order system and processors of the information they process on behalf of the other business.

The businesses are controllers of their respective information, and the staff are processors of this information

They are both joint controllers of the information contained in the single order system