PDP9 Exam Questions and Answers | Exam-Dumps (Page: 2)

QUESTION: 6

Which of the below would be the BEST example of processing that could utilise the Public Interest Task lawful basis?

A health authority processing the personal information of its staff in order to record all training undertaken
A debt collection agency processing information relating to unpaid fines for misuse of community council car parking.
A local authority processing the personal information of the person responsible for paying council tax
A tax authority drops cookies on the devices of visitors to its website

Answer(s): C

Explanation:

The public interest task lawful basis applies to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The relevant task or authority must have a clear basis in domestic law, such as a statutory power, a common law duty, or a function of the Crown, central or local government. The processing must also be necessary, meaning that there is no reasonable and less intrusive way to achieve the same purpose. The public interest task lawful basis is most relevant to public authorities, but it can also apply to any organisation that exercises official authority or carries out tasks in the public interest. In scenario C, a local authority processing the personal information of the person responsible for paying council tax is likely to rely on the public interest task lawful basis, as it is performing a task in the public interest that is laid down by law, namely the Local Government Finance Act 1992, and the processing is necessary for the collection and administration of council tax. In contrast, scenarios A, B and D are less likely to qualify for the public interest task lawful basis, as they do not involve a clear task or authority that is set out in law, or that serves the public interest. For example, a health authority processing the personal information of its staff in order to record all training undertaken may have a different lawful basis, such as legitimate interests or contractual necessity. A debt collection agency processing information relating to unpaid fines for misuse of community council car parking may not have any official authority or public interest justification for its processing. A tax authority dropping cookies on the devices of visitors to its website may not be able to demonstrate that the processing is necessary for its official functions, and may also need to comply with the Privacy and Electronic Communications Regulations (PECR) for the use of cookies.

Reference:

UK GDPR, Article 6 (1) (e) and (3)
ICO Guide to Data Protection, Public Task
Local Government Finance Act 1992

Reveal Solution Next Question

QUESTION: 7

Article 9(2)(c) of UK GDPR condition of processing special category data in the vital interests of the data subject is only applicable in which of the following circumstances:

When another lawful basis applies.
When a data subject is incapacitated
When the data subject is physically unable to be present
When the data subject refuses to consent

Answer(s): B

Explanation:

Article 9(2)© of UK GDPR allows the processing of special category data when it is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent. This means that the data subject is unable to exercise their right to consent or object to the processing, either because they are unconscious, in a coma, suffering from a severe mental disorder, or otherwise unable to communicate their wishes. This condition is intended to cover emergency situations, such as life-threatening medical interventions, where the data subject's consent cannot be obtained in time. It does not apply when another lawful basis applies, when the data subject is physically absent but still capable of giving consent, or when the data subject refuses to consent.

Reference:

Article 9(2)© of UK GDPR
ICO guidance on special category data

Reveal Solution Next Question

QUESTION: 8

What is the basis of the accountability and data governance obligation (Article 5 (2) of the GDPR)?

The controller shall appoint a DPO before carrying out large scale processing
The controller shall be responsible for. and be able to demonstrate compliance with the data protection principles.
Controllers and Processors each have a responsibility to conduct legitimate interests balancing tests before processing data for direct marketing
Processors have overarching responsibility to ensure their processing is compliant

Answer(s): B

Explanation:

Article 5(2) of the GDPR introduces the principle of accountability, which requires that the controller is responsible for, and be able to demonstrate compliance with, the data protection principles set out in Article 5(1). These principles are: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and data protection by design and by default. The controller must implement appropriate technical and organisational measures to ensure and demonstrate compliance, such as policies, procedures, records, audits, reviews, and DPIAs. The controller must also cooperate with the supervisory authority and provide any information requested by it. The other options are not the basis of the accountability and data governance obligation, although they may be related to other obligations under the GDPR.

Reference:

Article 5(2) of the GDPR
ICO guidance on accountability and governance

Reveal Solution Next Question

QUESTION: 9

Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?

It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
It is key to the accountability element of the GDPR.
It fulfils a requirement that data protection is carried out by design and default.
It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated

Answer(s): A

Explanation:

A DPIA is not required to fulfil the requirement that all DPIAs are submitted to the ICO, because this is not a requirement under the GDPR. The GDPR only requires that the controller consults the ICO before carrying out processing that is likely to result in a high risk to individuals, if the controller cannot mitigate that risk. This means that not all DPIAs need to be submitted to the ICO, only those that identify a high residual risk that cannot be reduced. The other options are valid purposes of carrying out a DPIA, as they help the controller to comply with the GDPR, ensure data protection by design and by default, and identify and mitigate the main risks to individuals' rights and freedoms.

Reference:

Article 35 and 36 of the GDPR
ICO guidance on DPIAs

Reveal Solution Next Question

QUESTION: 10

You are a consulting Data Protection Officer (DPO) for a holiday resort You have been asked to conduct a Data Protection Impact Assessment (DPIA) for them in advance of adopting a new HR management database.
While working through the DPIA, which of the following is NOT a requirement?

Describe the processing
Sign off and record outcomes.
Identify measures to mitigate the risks
Publish any potential risks in your information notice.

Answer(s): D

Explanation:

A DPIA is a process to help identify and minimise the data protection risks of a project that is likely to result in a high risk to individuals. A DPIA must include the following elements, according to Article 35(7) of the UK GDPR1:
a description of the processing, including its purposes and legal basis; an assessment of the necessity and proportionality of the processing in relation to its purposes; an assessment of the risks to the rights and freedoms of individuals; and the measures envisaged to address the risks and demonstrate compliance with the UK GDPR. There is no requirement to publish any potential risks in the information notice, which is a document that provides individuals with information about how their personal data is processed, as required by Article 13 and 14 of the UK GDPR2. However, it may be good practice to do so, as well as to consult with individuals or their representatives, where appropriate, as part of the DPIA process. This can help to enhance transparency, trust and accountability, and to identify any additional risks or concerns from the perspective of the data subjects.

Reference:

Article 35(7) of the UK GDPR

Article 13 and 14 of the UK GDPR

Reveal Solution Next Question

BCS PDP9 Exam (page: 2) BCS Practitioner Certificate in Data Protection Updated on: 12-Feb-2026

QUESTION: 6

Explanation:

Reference:

QUESTION: 7

Explanation:

Reference:

QUESTION: 8

Explanation:

Reference:

QUESTION: 9

Explanation:

Reference:

QUESTION: 10

Explanation:

Reference:

BCS PDP9 Exam (page: 2)
BCS Practitioner Certificate in Data Protection
Updated on: 12-Feb-2026