[Mar-2024] Get 100% Real Free BCS Practitioner PDP9 Sample Questions [Q18-Q41]

March 28, 2024 examdumps 0 Comment

Tags: PDP9 latest exam sample, PDP9 latest test lab questions, PDP9 reliable exam questions fee, PDP9 Training Tools, PDP9 valid exam voucher, PDP9 valid test camp, PDP9 valid test questions and answers

Rate this post

[Mar-2024] Get 100% Real Free BCS Practitioner PDP9 Sample Questions

Accurate PDP9 Questions with Free and Fast Updates

The PDP9 certification exam is an advanced level certification that requires candidates to have prior knowledge of data protection laws and regulations. It is ideal for professionals working in data protection, compliance, IT security, privacy, and risk management. BCS Practitioner Certificate in Data Protection certification exam is also suitable for individuals who want to enhance their career prospects in the data protection field.

NEW QUESTION 18
What is the meaning of storage limitation in relation to UK GDPR Article 5 (1 )(e)?

Keeping identifiable personal data for no longer than is necessary for the intended processing

Storing data in a secure format only permitting access to those with a business need

Only storing data in locations within the EU. except where there is an adequacy decision.

Limiting the number of records stored in any single repository to minimise risk surface.

NEW QUESTION 19
What are Information Society Services’? Select the INCORRECT answer

A service provided for remuneration, by electronic means, at distance to an individual that has requested it.

An electronic information service provided to individuals but paid for solely by advertising

Business to business online networking sites

Information services provided by non-profit or government organisations with no remuneration

NEW QUESTION 20
A UK public body has a security breach, in which the details of a hundred thousand members of the public are published What is the MAXIMUM fine that they could receive for this breach?

£17 5 million or 4% of gross annual turnover

£10 million or 4% of gross annual turnover

£20 million or 2% of gross annual turnover

£8.7 million or 2% of gross annual turnover

NEW QUESTION 21
Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?

It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO

It is key to the accountability element of the GDPR.

It fulfils a requirement that data protection is carried out by design and default.

It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated

NEW QUESTION 22
A company based in France uses a specialist IT support business in China The two companies have signed a Data Processing Agreement.The Chinese business provides specialist IT support for the French company’s digital customer experience platform No personal data is sent to China, but employees of the Chinese business access the platform on a regular basis and have access to the databases that sit behind it.Which of the following statements is CORRECT in relation to the French company’s requirements to ensure compliance with the GDPR?

No personal data is being transferred, therefore no transfer mechanism is needed

The French company must identify and implement an appropriate transfer mechanism

There is a Data Processing Agreement in place therefore no transfer mechanism is needed

China provides an adequate level of protection for personal data, therefore no transfer mechanism is needed

NEW QUESTION 23
Who is entitled to a private life by law in the UK?

All individuals.

All individuals save for Members of Parliament

Private individuals who do not conduct their business on public platforms (such as professional sports people and actors

Nobody

NEW QUESTION 24
Which one task are supervisory authorities NOT required to carry out under Article 57(1 )(f) of the UK GDPR? Select the CORRECT answer.

Handle complaints lodged by a data subject

Investigate complaints and inform the complainant of the progress of their investigation

Mediate between the complainant and the entity against which the complaint has been lodged, to resolve the complaint

Co-ordinate where necessary with other supervisory authorities

NEW QUESTION 25
In which of the following circumstances does a public authority NOT need to appoint a Data Protection Officer?

Where it processes a large amount of personal data

Where it is a court acting in its judicial capacity

Where it processes special category data

Where it is defined as a public body in the Data Protection Act 2018

NEW QUESTION 26
When were data protection rights first introduced into UK law’?

2000 (Data Protection Act 1998)

1992 (Data Protection Act 1992).

1984 (Data Protection Act 1984).

2018 (Data Protection Act 2018)

NEW QUESTION 27
An individual applies for a job as a security guard The employer has had significant issues with the sickness record of past recruits They therefore decide to offer the position to the individual on the basis they request a copy of their medical record so that the employer can be assured that they are in a good state of health.
The Data Protection Officer has been asked to advise. What advice is MOST appropriate?

Providing the medical evidence is used for a legitimate purpose, and that the information is securely destroyed on verification that the employee is healthy, this is an acceptable action.

While requesting and viewing medical evidence may be legitimate, they should ask for evidence that the individual consents to the proposition that they make the request

In requesting information that is more than they necessary require to verify the medical condition of the individual they will have breached the data minimisation principle

This is a criminal offence under the Data Protection Act 2018 No individual should be asked to make a subject access request in order to obtain health records in these circumstances.

NEW QUESTION 28
Under the Privacy and Electronic Communications Regulations, organisations must NOT make marketing telephone calls to which of the following?

Any person under the age of 18, unless their parent or guardian has provided permission

Any person who is registered with the Telephone Preference Service, unless they have given specific consent to receive your calls

Any person who has not consented to receiving marketing calls

Any person outside of the United Kingdom.

NEW QUESTION 29
In the terms of their relevance under data protection legislation, how can CCTV images recorded in a supermarket BEST be described’?

They are special category data as they identify special characteristics

They are biometric data in the terms of the definition stipulated in the GDPR.

The GDPR is only engaged where these are accompanied by text or other identifier

They are personal data as they can be used to identify living human beings

Explanation
CCTV images recorded in a supermarket are personal data as they can be used to identify living human beings, either directly or indirectly, by their physical appearance, clothing, accessories, or other distinctive features.
Personal data is defined in Article 4(1) of the GDPR as “any information relating to an identified or identifiable natural person”. The GDPR applies to the processing of personal data by automated means, such as CCTV cameras, or by non-automated means that form part of a filing system, such as paper records. The other options are incorrect because:
* CCTV images are not special category data as they do not reveal any of the sensitive information listed in Article 9(1) of the GDPR, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, or biometric or genetic data.
Special category data is subject to stricter conditions and safeguards under the GDPR, as it poses a higher risk to the rights and freedoms of individuals.
* CCTV images are not biometric data in the terms of the definition stipulated in the GDPR. Biometric data is defined in Article 4(14) of the GDPR as “personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data”. CCTV images do not result from specific technical processing, nor do they allow or confirm the unique identification of a natural person, unless they are combined with other data or identifiers.
* The GDPR is not only engaged where CCTV images are accompanied by text or other identifier. The GDPR applies to any information that relates to an identified or identifiable natural person, regardless of whether it is accompanied by text or other identifier. CCTV images can relate to an identifiable natural person even if they do not contain any text or other identifier, as long as there is a possibility to single out or link the person to other data or factors. References:
* GDPR, Article 4(1)1
* GDPR, Article 2(1)2
* GDPR, Article 9(1)3
* GDPR, Article 4(14)4

NEW QUESTION 30
If a complainant disagrees with the decision of the UK’s supervisory authority, how do they appeal this decision?

To the First Tier Tribunal (Information Rights)

To the Information Commissioner

To the European Data Protection Supervisor.

To the European Commission

NEW QUESTION 31
Which of the following statements are CORRECT about records of processing’?
A It must contain contact details for the Data Protection Officer where applicable.
B It must be submitted to the Information Commissioner’s Office following every Data Protection ImpactAssessment C It is mandatory for all data processors D The controller or the processor a mustmakesthe record available to the supervisory authority on request
E. It must contain contact details for the supervisory authority

B, C. and D

A,C,andE

A. C,D, and E

A, C,andD

NEW QUESTION 32
Which of the following statements MOST accurately describes the potential impact of Al on the principle of transparency?

Data subjects should generally expect Al to be present in processing activities

Transparency requirements do not apply to Al, as it is always compatible with original purposes

Al can lead to invisible processing, with data subjects not being aware of its presence.

Transparency requirements do not apply to Al, as there is a relevant exemption

NEW QUESTION 33
What does NOT have an exemption prescribed under schedule 3 of the Data Protection Act 2018?

Social Work Data.

Credit checking agency data

Education data, examination scripts and marks

Health data

NEW QUESTION 34
When does a personal data breach need to be reported to a supervisory authority?

All personal data breaches must be reported to a supervisory authority

Only where a disclosure is of special category data

Where the personal data breach is likely to result in a risk to the rights and freedoms of natural persons.

When the controller’s right of freedom of expression outweighs the data subject’s right to a private home and family life.

Explanation
Article 33 of the UK GDPR requires controllers to notify the supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. This means that not all personal data breaches need to be reported to the supervisory authority, only those that pose a risk to individuals. The risk should be assessed in terms of the potential negative consequences for individuals, such as discrimination, identity theft, fraud, financial loss, damage to reputation, loss of confidentiality, or any other significant economic or social disadvantage. The UK GDPR also requires controllers to communicate the personal data breach to the affected data subjects without undue delay, where the breach is likely to result in a high risk to their rights and freedoms. The other options are incorrect because:
* The UK GDPR does not require all personal data breaches to be reported to the supervisory authority, only those that pose a risk to individuals. However, controllers must document all personal data breaches, regardless of whether they are reported or not, as part of their accountability obligations.
* The UK GDPR does not make a distinction between personal data and special category data when it comes to reporting personal data breaches. Special category data is a type of personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or that concerns health, sex life or sexual orientation, or biometric or genetic data for the purpose of uniquely identifying a natural person. The processing of special category data is subject to stricter conditions and safeguards under the UK GDPR, but the reporting of personal data breaches involving such data is subject to the same criteria as any other personal data breach, namely the risk to individuals.
* The UK GDPR does not provide an exemption from reporting personal data breaches based on the controller’s right of freedom of expression. The right of freedom of expression is a fundamental right that is recognised and protected by the UK GDPR, but it is not an absolute right that overrides the rights and freedoms of data subjects. The UK GDPR allows Member States to provide for exemptions or derogations from certain provisions of the UK GDPR for the processing of personal data carried out for journalistic purposes or the purpose of academic, artistic or literary expression, where such exemptions or derogations are necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information. However, these exemptions or derogations do not apply to the obligation to report personal databreaches to the supervisory authority, unless the Member State law specifies otherwise. References:
* UK GDPR, Article 334
* UK GDPR, Article 34
* UK GDPR, Article 9
* UK GDPR, Article 85