Practice Test Geeks(GDPR) Certified General Data Protection Regulation Specialist Practice Test
← All GDPR Flashcard Decks

Security & Access Management Flashcards

7 cards from real GDPR practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Security & Access Management flashcards as text

  1. Which GDPR provision explicitly requires organisations to test, assess, and evaluate the effectiveness of security measures on an ongoing basis?

    Answer: Article 32(1)(d) — regular testing and evaluation of technical and organisational measures

    Article 32(1)(d) specifically requires a process for regularly testing, assessing, and evaluating the effectiveness of security measures.

  2. A SaaS company acting as a processor wants to engage a sub-processor to handle EU personal data. What does GDPR require?

    Answer: Prior specific or general written authorisation from the controller is required before engaging sub-processors

    Article 28(2) requires processors to obtain prior specific or general written authorisation from the controller before engaging sub-processors.

  3. An insider threat involves a database administrator copying personal data to a personal USB drive. Which technical control would most directly prevent this under a GDPR-compliant security programme?

    Answer: Data Loss Prevention (DLP) technology blocking unauthorised USB transfers

    DLP technology provides the technical control to detect and block unauthorised copying of personal data to external devices, directly addressing the insider threat vector.

  4. Under GDPR, if a security breach affects personal data but is unlikely to result in any risk to individuals, what is the controller's obligation?

    Answer: Document the breach internally but no external notification is required

    Article 33(1) exempts controllers from supervisory authority notification when a breach is unlikely to result in a risk to individuals — however, internal documentation under Article 33(5) is still required.

  5. A multinational company processes employee data across 15 EU member states. Which supervisory authority should they primarily notify in the event of a data breach under the GDPR one-stop-shop mechanism?

    Answer: The lead supervisory authority in the member state of their EU main establishment

    Under the one-stop-shop mechanism (Article 56), the lead supervisory authority is determined by the controller's main establishment in the EU.

  6. What information must a controller include in a breach notification to a supervisory authority under Article 33(3)?

    Answer: Nature of the breach, categories and approximate numbers affected, DPO contact details, likely consequences, and measures taken

    Article 33(3) specifies the notification must include nature of breach, categories/numbers of data subjects and records affected, DPO contact, likely consequences, and remedial measures taken or proposed.

  7. An organisation encrypts all personal data such that a breach results in ciphertext that cannot be decrypted by attackers. How does GDPR treat this scenario regarding individual notification?

    Answer: Individual notification may not be required if the data was rendered unintelligible to unauthorised persons

    Article 34(3)(a) exempts controllers from individual notification when appropriate technical measures like encryption rendered the data unintelligible to unauthorised persons.