GDPR Quiz: 12 Questions With Answers

Answer: One month from receipt, extendable by two further months for complex or numerous requests

Article 12(3) sets one month from receipt. It can be extended by two further months where necessary, and the person must be told about the extension, with reasons, within the first month. "30 days" is a common shorthand but the law says one month, and 45 + 45 days is the California (CCPA) rule.

“without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary”

Answer: Without undue delay and, where feasible, within 72 hours of becoming aware of it

Article 33(1) sets 72 hours from the moment the controller becomes aware of the breach. Notification is not needed if the breach is unlikely to result in a risk to people. A processor that discovers a breach must tell the controller without undue delay (Article 33(2)). A pending EU proposal would change this rule, but 72 hours is the law today.

“the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority”

Answer: When the breach is likely to result in a high risk to their rights and freedoms

Article 34(1) requires telling individuals without undue delay when the breach is likely to result in a high risk. That bar is higher than the "risk" test for notifying the authority. It is not needed if, for example, the data was protected by measures such as encryption that make it unintelligible (Article 34(3)). The 500-person figure comes from US HIPAA breach rules, not GDPR.

“likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.”

Answer: Up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher

Article 83(5)(b) puts data subject rights in the higher tier: €20 million or 4% of worldwide annual turnover, whichever is higher. The €10 million / 2% tier in Article 83(4) covers obligations such as security and breach notification (Articles 25 to 39). Both are maximums; the authority sets the actual amount case by case.

“up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher”

Answer: The data is publicly available online

The six lawful bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. Data being public is not a lawful basis; you still need one of the six. Consent is only one option, so not every use of personal data needs consent.

“Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent”

Answer: Controller

The controller decides the purposes and means of processing (Article 4(7)). The CRM vendor processes data on the controller's behalf, which makes it a processor (Article 4(8)). When a processor engages another processor, that second company is usually called a sub-processor (Article 28).

“‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”

Answer: A company whose core activities involve regular and systematic monitoring of individuals on a large scale

Article 37(1) has three triggers: public authorities, core activities that need large-scale regular and systematic monitoring, and core activities that involve large-scale processing of special category or criminal data. Headcount is not a trigger; the 250-employee figure belongs to the records-of-processing rule in Article 30(5). National law can require a DPO in more cases (Article 37(4)).

“the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale”

Answer: Before processing that is likely to result in a high risk to people's rights and freedoms

Article 35(1) requires a DPIA before high-risk processing starts, especially with new technologies. Article 35(3) names cases that always need one, such as profiling that produces legal or similarly significant effects, and large-scale processing of special category data. Supervisory authorities also publish lists of processing that needs a DPIA (Article 35(4)).

“is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact”

Answer: You need it to comply with a legal obligation, such as a statutory record-keeping requirement

Article 17(3) lists the exceptions, including compliance with a legal obligation and the establishment, exercise or defence of legal claims. Business usefulness and technical difficulty are not exceptions. Consent can be withdrawn at any time (Article 7(3)). Keep only what the obligation requires and erase the rest.

“Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: ... (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject”

Answer: Yes. Data that can be linked back to a person using additional information is still personal data

Recital 26 says pseudonymised data that can be attributed to a person with additional information is still personal data. Only truly anonymous data, where people are no longer identifiable, falls outside GDPR. Pseudonymisation is still a recommended safeguard (Articles 25 and 32); it reduces risk but does not take the data out of scope.

“Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.”

Answer: Yes. GDPR applies when a company outside the EU offers goods or services to people in the EU

Article 3(2) extends GDPR to companies outside the EU that offer goods or services to people in the EU, or monitor their behaviour in the EU. The test is where the person is, not their citizenship or where the servers are. Such a company usually also needs an EU representative (Article 27).

“the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services”

Answer: Data concerning health

Article 9(1) lists special categories, including health, genetic and biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and sex life or sexual orientation. Processing them is prohibited unless an Article 9(2) condition applies, such as explicit consent. An email or IP address can be personal data, but it is not special category data.

“Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health”