Amazon
Anthropic
Avaya
Cisco
CompTIA
CrowdStrike
EC-Council
EXIN
Fortinet
Google
ISC
ISC2
ITIL
Juniper
Microsoft
NVIDIA
Palo Alto Networks
Salesforce
SAP
VMware
All Vendors

PECB Certified Data Protection Officer GDPR Dumps in PDF

Free PECB GDPR Real Questions (page: 1)

GDPR PDF — 80 Questions

Scenario 1:

MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs.

Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic dat

  1. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
    MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed.
    Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients' requests to stop data processing are rejected. This decision was made by MED's top management to retain the information of everyone registered in their databases.
    The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
    MED believes that it is its responsibility to ensure the security and accuracy of patients' personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
    Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.
    Questio n:
    If a patient requests MED to permanently erase their data, MED should:
  2. Reject the request since the medical history of patients cannot be permanently erased.
  3. Erase the personal data if it is no longer needed for its original purpose.
  4. Erase the personal data only if required to comply with a legal obligation.
  5. Refuse the request because medical data must be retained indefinitely for future reference.

Answer(s): B

Explanation:

Under Article 17 of the General Data Protection Regulation (GDPR), also known as the "Right to be Forgotten," data subjects have the right to request the erasure of their personal data when:

The data is no longer necessary for the purpose for which it was collected.

The data subject withdraws consent (where processing was based on consent).

The data was processed unlawfully.

In this scenario, if the data is no longer necessary for the original purpose (e.g., if the patient has completed their treatment and there are no legal retention obligations), MED should erase the data. However, there are exceptions under GDPR, such as legal retention requirements for medical records under national healthcare regulations.

Rejecting the request outright (Option A) is incorrect because GDPR requires controllers to assess whether retention is still necessary. Similarly, Option C is too restrictive because GDPR allows deletion even if no legal obligation mandates it. Option D is incorrect because indefinite retention is not permitted unless a valid justification exists.


Reference:

GDPR Article 17 (Right to Erasure)

Recital 65 (Clarification on when personal data can be erased)

Article 5(1)(e) (Storage limitation principle)



Scenario 1:

MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs.
Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic dat

  1. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
    MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed.
    Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients' requests to stop data processing are rejected. This decision was made by MED's top management to retain the information of everyone registered in their databases.
    The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
    MED believes that it is its responsibility to ensure the security and accuracy of patients' personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
    Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.
    Questio n:
    Based on scenario 1, is the processing of children's personal data performed by MED in compliance with GDPR?
  2. No, the processing of personal data of children below the age of 16 years is not in compliance with the GDPR, even if parental consent is provided.
  3. Yes, the processing of children's personal data below the age of 16 years with parental consent is in compliance with GDPR.
  4. No, MED must obtain explicit consent from the child, regardless of parental consent, for the processing to be in compliance with GDPR.
  5. Yes, as long as the processing is conducted with industry-standard encryption.

Answer(s): B

Explanation:

Under Article 8 of the GDPR, the processing of personal data of children under 16 years is only lawful if parental or guardian consent is obtained. However, Member States can lower the age limit to 13 years if they choose.

In this scenario, MED requires parental consent for children below 16 years, which aligns with GDPR requirements. Therefore, Option B is correct. Option A is incorrect because GDPR allows parental consent. Option C is incorrect because GDPR does not require explicit consent from the child when parental consent is given. Option D is incorrect because encryption alone does not determine compliance.


Reference:

GDPR Article 8 (Conditions for children's consent)

Recital 38 (Protection of children's data)



Scenario 1:

MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs.

Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic dat

  1. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
    MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed.
    Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients' requests to stop data processing are rejected. This decision was made by MED's top management to retain the information of everyone registered in their databases.
    The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
    MED believes that it is its responsibility to ensure the security and accuracy of patients' personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
    Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.
    Questio n:
    Considering the nature of data processing activities described in scenario 1, is GDPR applicable to MED?
  2. Yes, GDPR is applicable to MED due to its processing activities involving personal information.
  3. Yes, MED's use of cloud-based software to store and process health-related information necessitates compliance with GDPR's data protection requirements.
  4. No, MED's activities include healthcare services within one of the four EFTA states, which do not fall under the scope of GDPR.
  5. No, because MED operates only in Norway, and GDPR does not apply to domestic processing.

Answer(s): A

Explanation:

GDPR applies to any organization that processes personal data of individuals within the European Economic Area (EEA), regardless of the organization's location. Since MED is based in Norway, which is an EEA country, and processes personal health data, it must comply with GDPR.

Option A is correct because GDPR applies to all controllers and processors within the EEA. Option B is misleading because while cloud-based software is relevant, the primary reason GDPR applies is MED's processing of personal data. Option C is incorrect because EFTA states (including Norway) are subject to GDPR. Option D is incorrect because GDPR applies to all personal data processing in the EEA.


Reference:

GDPR Article 3 (Territorial Scope)

Recital 22 (GDPR applies to EEA countries)



Scenario 1:

MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs.

Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic dat

  1. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
    MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed.
    Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients' requests to stop data processing are rejected. This decision was made by MED's top management to retain the information of everyone registered in their databases.
    The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
    MED believes that it is its responsibility to ensure the security and accuracy of patients' personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
    Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.

    Questio n:
    Based on scenario 1, MED shares patients' personal data with a health insurance company. Does MED comply with the purpose limitation principle?
  2. Yes, personal data may be used for purposes in the public interest or statistical purposes in accordance with Article 89 of GDPR.
  3. Yes, using personal data for creating health insurance plans is within the scope of the data collection purpose.
  4. No, personal data should be collected for specified, explicit, and legitimate purposes in accordance with Article 5 of GDPR.
  5. Yes, as long as the data is encrypted before sharing.

Answer(s): C

Explanation:

Under Article 5(1)(b) of GDPR, personal data must be collected for specific, explicit, and legitimate purposes and cannot be further processed in a manner incompatible with those purposes. Sharing medical data with an insurance company is a separate purpose and requires explicit consent or another lawful basis.


Reference:

GDPR Article 5(1)(b) (Purpose limitation)



Scenario 1:

MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs.

Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic dat

  1. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
    MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed.
    Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients' requests to stop data processing are rejected. This decision was made by MED's top management to retain the information of everyone registered in their databases.
    The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
    MED believes that it is its responsibility to ensure the security and accuracy of patients' personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
    Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.

    Questio n:
    Based on scenario 1, which data subject right is NOT guaranteed by MED?
  2. Right to be informed
  3. Right to restriction of processing
  4. Right to data portability
  5. Right to rectification

Answer(s): B

Explanation:

Under Article 18 of GDPR, the right to restriction of processing allows data subjects to request that processing of their personal data be limited under certain conditions, such as when accuracy is contested or processing is unlawful but the data subject opposes erasure.

From the scenario, MED does not provide the option to restrict processing, as patients who request to stop processing are denied. This makes Option B correct. Option A is incorrect because MED does inform patients about data collection purposes. Option C is incorrect because medical data could be transferred to other institutions. Option D is incorrect because rectification of inaccurate data is a standard obligation.


Reference:

GDPR Article 18 (Right to restriction of processing)

GDPR Article 12 (Transparent communication with data subjects)



PDF
Viewing page 1 of 17

Share your comments for PECB GDPR exam with other users:

Y
YK
12/11/2023 1:10:00 AM

good one nice

JAPAN
D
de
8/28/2023 2:38:00 AM

please continue

GERMANY
D
DMZ
6/25/2023 11:56:00 PM

this exam dumps just did the job. i donot want to ruffle your feathers but your exam dumps and mock test engine is amazing.

UNITED KINGDOM
J
Jose
8/30/2023 6:14:00 AM

nice questions

PORTUGAL
T
Tar01
7/24/2023 7:07:00 PM

the explanation are really helpful

Anonymous
D
DaveG
12/15/2023 4:50:00 PM

just passed my exam yesterday on my first attempt. these dumps were extremely helpful in passing first time. the questions were very, very similar to these questions!

Anonymous
A
A.K.
6/30/2023 6:34:00 AM

cosmos db is paas not saas

Anonymous
S
S Roychowdhury
6/26/2023 5:27:00 PM

what is the percentage of common questions in gcp exam compared to 197 dump questions? are they 100% matching with real gcp exam?

Anonymous
B
Bella
7/22/2023 2:05:00 AM

not able to see questions

Anonymous
S
Scott
9/8/2023 7:19:00 AM

by far one of the best sites for free questions. i have pass 2 exams with the help of this website.

CANADA
D
donald
8/19/2023 11:05:00 AM

excellent question bank.

Anonymous
A
Ashwini
8/22/2023 5:13:00 AM

it really helped

Anonymous
S
sk
5/13/2023 2:07:00 AM

excelent material

INDIA
C
Christopher
9/5/2022 10:54:00 PM

the new versoin of this exam which i downloaded has all the latest questions from the exam. i only saw 3 new questions in the exam which was not in this dump.

CANADA
S
Sam
9/7/2023 6:51:00 AM

question 8 - can cloudtrail be used for storing jobs? based on aws - aws cloudtrail is used for governance, compliance and investigating api usage across all of our aws accounts. every action that is taken by a user or script is an api call so this is logged to [aws] cloudtrail. something seems incorrect here.

UNITED STATES
T
Tanvi Rajput
8/14/2023 10:55:00 AM

question 13 tda - c01 answer : quick table calculation -> percentage of total , compute using table down

UNITED KINGDOM
P
PMSAGAR
9/19/2023 2:48:00 AM

pls share teh dump

UNITED STATES
Z
zazza
6/16/2023 10:47:00 AM

question 44 answer is user risk

ITALY
P
Prasana
6/23/2023 1:59:00 AM

please post the questions for preparation

Anonymous
T
test user
9/24/2023 3:15:00 AM

thanks for the questions

AUSTRALIA
D
Draco
7/19/2023 5:34:00 AM

please reopen it now ..its really urgent

UNITED STATES
M
Megan
4/14/2023 5:08:00 PM

these practice exam questions were exactly what i needed. the variety of questions and the realistic exam-like environment they created helped me assess my strengths and weaknesses. i felt more confident and well-prepared on exam day, and i owe it to this exam dumps!

UNITED KINGDOM
A
abdo casa
8/9/2023 6:10:00 PM

thank u it very instructuf

Anonymous
D
Danny
1/15/2024 9:10:00 AM

its helpful?

INDIA
H
hanaa
10/3/2023 6:57:00 PM

is this dump still valid???

Anonymous
G
Georgio
1/19/2024 8:15:00 AM

question 205 answer is b

Anonymous
M
Matthew Dievendorf
5/30/2023 9:37:00 PM

question 39, should be answer b, directions stated is being sudneted from /21 to a /23. a /23 has 512 ips so 510 hosts. and can make 4 subnets out of the /21

Anonymous
A
Adhithya
8/11/2022 12:27:00 AM

beautiful test engine software and very helpful. questions are same as in the real exam. i passed my paper.

UNITED ARAB EMIRATES
S
SuckerPumch88
4/25/2022 10:24:00 AM

the questions are exactly the same in real exam. just make sure not to answer all them correct or else they suspect you are cheating.

UNITED STATES
S
soheib
7/24/2023 7:05:00 PM

question: 78 the right answer i think is d not a

Anonymous
S
srija
8/14/2023 8:53:00 AM

very helpful

EUROPEAN UNION
T
Thembelani
5/30/2023 2:17:00 AM

i am writing this exam tomorrow and have dumps

Anonymous
A
Anita
10/1/2023 4:11:00 PM

can i have the icdl excel exam

Anonymous
B
Ben
9/9/2023 7:35:00 AM

please upload it

Anonymous
AI Tutor 👋 I’m here to help!