Practice Test Geeks(GDPR) Certified General Data Protection Regulation Specialist Practice Test
← All GDPR Flashcard Decks

Data Management & Integration Flashcards

7 cards from real GDPR practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Data Management & Integration flashcards as text

  1. A healthcare organisation integrates patient records with a research database. Which GDPR provision most directly permits processing special-category data for scientific research?

    Answer: Article 9(2)(j) — scientific research with appropriate safeguards

    Article 9(2)(j) allows processing special-category data for scientific research purposes, provided appropriate safeguards such as pseudonymisation are applied.

  2. A company uses pseudonymisation when integrating datasets. According to GDPR, pseudonymised data is best described as:

    Answer: Personal data that can no longer be attributed to a specific individual without additional information

    Recital 26 and Article 4(5) define pseudonymised data as personal data that cannot be attributed to a specific data subject without additional information held separately.

  3. During a master data management (MDM) initiative, an organisation plans to create a 'golden record' consolidating personal data from five source systems. What GDPR principle requires that only necessary data fields be included in the golden record?

    Answer: Data minimisation

    Article 5(1)(c) data minimisation requires that personal data be adequate, relevant, and limited to what is necessary for the specified purpose.

  4. An API integration passes personal data between two controllers' systems in real time. Which security measure is most important to implement under Article 32 of the GDPR?

    Answer: Encrypting data in transit using TLS

    Article 32 requires appropriate technical measures including encryption; TLS encryption protects personal data in transit between systems.

  5. A joint data integration project involves two separate companies both determining the purposes and means of processing. Under GDPR, they are classified as:

    Answer: Joint controllers under Article 26

    Article 26 defines joint controllers as two or more entities that jointly determine the purposes and means of processing and requires a transparent arrangement between them.

  6. A data warehouse retains personal data from closed customer accounts for seven years for tax compliance purposes. Which GDPR legal basis is most appropriate for this retention?

    Answer: Compliance with a legal obligation under Article 6(1)(c)

    Article 6(1)(c) permits processing necessary to comply with a legal obligation, such as statutory tax record-keeping requirements.

  7. Under GDPR's accountability principle, what document should an organisation maintain to demonstrate compliance in a complex multi-system data integration environment?

    Answer: Records of Processing Activities (RoPA) under Article 30

    Article 30 requires controllers to maintain records of processing activities, which serve as a key accountability tool across all processing, including integrated data flows.