PC-DP sample questions

Question 1

True or False: A cloud software provider headquartered exclusively in Tokyo, Japan, with no offices or representatives in the United Kingdom, offers a specialized accounting application. The application allows users to select 'Great British Pounds (GBP)' as a currency, provides a dedicated UK customer service phone line, and actively runs targeted social media campaigns aimed at London-based financial firms. Under Article 3 of the UK GDPR, the Tokyo-based provider is completely exempt from UK data protection legislation because they have no physical establishment in the UK.

Accepted Answer

False

Answer

True

Question 2

Following the UK's departure from the European Union, the legislative framework for data protection in the UK underwent significant structural changes. Which of the following best describes the core mechanism that established the 'UK GDPR'?

Accepted Answer

The EU GDPR was retained in domestic law by the European Union (Withdrawal) Act 2018 and subsequently amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 to create the UK GDPR.

Answer

The Council of Europe Convention 108 was directly elevated to act as the primary statutory data protection framework in the UK, superseding the Data Protection Act 2018.

Answer

The UK reverted entirely to the Data Protection Act 1998, with minor amendments to accommodate modern cloud computing environments.

Answer

The UK Parliament drafted an entirely new bill from scratch known as the Data (Use and Access) Act, which immediately replaced all EU regulations on January 1, 2021.

Question 3

HealthScan Diagnostics is conducting a clinical trial. To protect patient privacy, the data engineering team strips all direct identifiers (names, NHS numbers) from the dataset and replaces them with a unique alphanumeric string (e.g., 'Patient-77X9'). The mapping table that links 'Patient-77X9' back to the individual's actual identity is kept on an isolated, highly secure server accessible only by the Chief Medical Officer.

Which of the following statements accurately categorizes this dataset under the UK GDPR?

Accepted Answer

The dataset has undergone pseudonymisation. Because the additional information (the mapping table) exists that allows the data to be attributed to specific data subjects, the dataset remains personal data and is subject to the UK GDPR.

Answer

The dataset is considered non-personal data as long as the Chief Medical Officer signs a non-disclosure agreement preventing the release of the mapping table.

Answer

The dataset is considered completely anonymized because the researchers working with the data do not have access to the mapping table. Therefore, the dataset falls entirely outside the scope of the UK GDPR.

Answer

The dataset is classified as biometric data because it relates to health outcomes, and therefore it is automatically exempt from standard UK GDPR processing principles.

Question 4

A retail banking institution originally collected customer transaction data solely for the purpose of executing payments and preventing financial fraud. Two years later, the marketing department wants to extract this transaction data, aggregate it, and feed it into an external AI marketing tool to predict future consumer purchasing trends and send highly targeted third-party advertisements.

When evaluating this new processing activity against the Article 5(1)(b) 'Purpose Limitation' principle, which factor is the bank required to assess?

Accepted Answer

The bank must assess whether the new purpose (targeted third-party marketing) is compatible with the original purposes (executing payments and fraud prevention) for which the data was collected.

Answer

The bank is not required to assess anything, because financial institutions are granted an automatic exemption from the purpose limitation principle under the DPA 2018.

Answer

The bank only needs to assess if the data has been stored for less than five years, as purpose limitation automatically expires after half a decade.

Answer

The bank must assess whether the external AI marketing tool uses AES-256 encryption, as purpose limitation only applies to unencrypted datasets.

Question 5

A registered trade union in the UK has developed a mobile application for its members. The app actively collects data revealing the members' political opinions and trade union membership status to organize local rallies.

Under Article 9 of the UK GDPR and Schedule 1 of the DPA 2018, which TWO of the following represent valid conditions that the trade union could potentially rely upon to lawfully process this special category data? (Select TWO)

Accepted Answer

The processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or not-for-profit body with a political, philosophical, religious or trade union aim.

Accepted Answer

The data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

Answer

The processing is necessary to protect the economic interests of the controller in a highly competitive market.

Answer

The processing is necessary for the purposes of the legitimate interests pursued by the trade union, overriding the fundamental rights of the data subject.

Answer

The processing is necessary for the performance of a standard commercial contract to which the data subject is a party.

Question 6

A large logistics company wants to install advanced telematics and cabin-facing cameras in all its delivery trucks to monitor driver fatigue and harsh braking. The HR department suggests asking employees to sign a consent form authorizing this tracking. The Data Protection Officer (DPO) advises against using 'Consent' as the lawful basis and recommends 'Legitimate Interests' instead.

Why is the DPO's advice technically correct in this specific employment context?

Accepted Answer

Due to the inherent imbalance of power between an employer and an employee, consent is rarely considered 'freely given.' Legitimate Interests, subject to a balancing test (LIA), is a more appropriate and robust lawful basis.

Answer

Because the company is acting as a public authority when managing road safety, and public authorities are legally mandated to only use the 'Public Task' lawful basis.

Answer

Because consent forms must be renewed every 30 days under UK GDPR, making it administratively impossible for a large logistics company to maintain.

Answer

Because telematics data automatically classifies as criminal offence data, and consent can never be used to process criminal offence data under any circumstances.

Free PC-DP sample questions

Following the UK's departure from the European Union, the legislative framework for data protection in the UK underwent significant structural changes. Which of the following best describes the core mechanism that established the 'UK GDPR'?

6 more free samples are waiting