Updated Jan-2024 Exam PDP9 Dumps - Pass Your Certification Exam
Latest Real BCS PDP9 Exam Dumps Questions
BCS Practitioner Certificate in Data Protection (PDP9) is a highly respected and sought-after certification for professionals working in the field of data protection. BCS Practitioner Certificate in Data Protection certification is awarded by the British Computer Society (BCS), a leading professional body for IT professionals in the UK. The PDP9 exam covers a wide range of topics related to data protection, including data privacy regulations, data security, data breaches, and data management.
NEW QUESTION # 21
Under which circumstances can the 'domestic purposes' exemption be used to justify non-compliance with the Data Protection Act 2018?
A)An individual sells make up products for commission and uses social media to promote products to friends and family B)A couple are planning their daughter's wedding and use excel to store contact details and dietary needs of the guests C)An individual employs a babysitter and stores her bank details in an encrypted document in order to make payments D)A pansh council keeps a spreadsheet to manage bookings of the village hall, it contains only contact information and time slots E)A group of students are arranging a house party and using social media to invite people that they do and do not know
- A. B,and C
- B. A,B, C, and E.
- C. B. C. D, and E
- D. A. B.C. and D
Answer: A
Explanation:
Explanation
The domestic purposes exemption applies to personal data processed by an individual only for the purposes of their personal, family or household affairs. This means that theprocessing has no connection to any professional or commercial activity. Examples of such processing include writing to friends and family, taking pictures for personal enjoyment, or keeping an address book. However, the exemption does not apply if the individual processes personal data outside the reasonable expectations of the data subject, or if the processing causes unwarranted harm to the data subject's interests. Therefore, the exemption can be used to justify non-compliance with the Data Protection Act 2018 in scenarios B and C, where the processing is purely personal and does not affect the rights and freedoms of others. However, the exemption cannot be used in scenarios A, D and E, where the processing has a professional or commercial element, or involves sharing personal data with third parties without consent or legitimate interest. References:
* Data Protection Act 2018, Schedule 2, Part 1, Paragraph 21
* ICO Guide to Data Protection, Domestic Purposes2
* ICO Guide to Data Protection, Exemptions3
NEW QUESTION # 22
When were data protection rights first introduced into UK law'?
- A. 1984 (Data Protection Act 1984).
- B. 2000 (Data Protection Act 1998)
- C. 2018 (Data Protection Act 2018)
- D. 1992 (Data Protection Act 1992).
Answer: A
Explanation:
Explanation
Data protection rights were first introduced into UK law by the Data Protection Act 1984, which was enacted to implement the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 1981. The Data Protection Act 1984 established a set of principles for the processing of personal data by data users, such as obtaining consent, ensuring accuracy, and limiting retention.
It also created a system of registration for data users and a Data Protection Registrar (later renamed as the Information Commissioner) to oversee and enforce the law. The Data Protection Act 1984 was replaced by the Data Protection Act 1998, which transposed the EU Data Protection Directive 1995 into UK law and extended the scope of data protection to cover manual as well as automated processing of personal data. The Data Protection Act 1998 was further amended by the Data Protection Act 2018, which incorporated the EU General Data Protection Regulation (GDPR) and the Law Enforcement Directive into UK law and made provisions for specific processing situations, such as national security, immigration, and journalism.
References:
* Data Protection Act 19844
* Council of Europe Convention 1085
* Data Protection Act 19986
* Data Protection Act 20187
NEW QUESTION # 23
Which one task are supervisory authorities NOT required to carry out under Article 57(1 )(f) of the UK GDPR? Select the CORRECT answer.
- A. Co-ordinate where necessary with other supervisory authorities
- B. Investigate complaints and inform the complainant of the progress of their investigation
- C. Handle complaints lodged by a data subject
- D. Mediate between the complainant and the entity against which the complaint has been lodged, to resolve the complaint
Answer: D
Explanation:
Explanation
Article 57(1)(f) of the UK GDPR requires the supervisory authority (the ICO in the UK) to handle complaints lodged by a data subject, investigate the subject matter of the complaint, and inform the complainant of the progress and the outcome of the investigation. It also requires the supervisory authority to cooperate with other supervisory authorities if the complaint involves cross-border processing. However, it does not require the supervisory authority to mediate between the complainant and the controller or processor against which the complaint has been lodged, to resolve the complaint. This is not a task of the supervisory authority under the UK GDPR, although it may be possible in some cases as a way of achieving an amicable solution. References
:
* Article 57(1)(f) of the UK GDPR1
* ICO and complaints2
NEW QUESTION # 24
Article 9(2)(c) of UK GDPR condition of processing special category data in the vital interests of the data subject is only applicable in which of the following circumstances:
- A. When the data subject refuses to consent
- B. When a data subject is incapacitated
- C. When another lawful basis applies.
- D. When the data subject is physically unable to be present
Answer: B
Explanation:
Explanation
Article 9(2) of UK GDPR allows the processing of special category data when it is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent. This means that the data subject is unable to exercise their right to consent or object to the processing, either because they are unconscious, in a coma, suffering from a severe mental disorder, or otherwise unable to communicate their wishes. This condition is intended to cover emergency situations, such as life-threatening medical interventions, where the data subject's consent cannot be obtained in time. It does not apply when another lawful basis applies, when the data subject is physically absent but still capable of giving consent, or when the data subject refuses to consent. References:
* Article 9(2) of UK GDPR1
* ICO guidance on special category data2
NEW QUESTION # 25
A company has twenty retail outlets in France and thirty retail outlets in Belgium The payroll department and the Data Protection Officer are based in Poland.The Company Board and administrative functions are based in Germany. Determine where the company's 'mainestablishment' would be
- A. France
- B. Belgium
- C. Germany
- D. Poland
Answer: C
Explanation:
Explanation
The main establishment of a controller or a processor in the EU is the place where the decisions on the purposes and means of the processing of personal data are taken and implemented. According to Recital 36 of the GDPR, the main establishment of a controller with establishments in more than one Member State should be the place of its central administration in the EU, unless the decisions on the processing are taken in another establishment of the controller in the EU and the latter establishment has the power to have such decisions implemented, in which case the establishment havingtaken such decisions should be considered to be the main establishment. Similarly, the main establishment of a processor with establishments in more than one Member State should be the place of its central administration in the EU, or, if the processor has no central administration in the EU, the establishment of the processor in the EU where the main processing activities take place to the extent that the processor is subject to specific obligations under the GDPR. The main establishment is relevant for determining the lead supervisory authority, the applicable law, and the jurisdiction of the courts for cross-border processing of personal data. In this case, the company's main establishment would be Germany, as it is the place where the company board and administrative functions are based and where the decisions on the processing of personal data are likely to be taken and implemented.
References:
* Recital 36 of the GDPR8
* Article 4(16) of the GDPR9
* Article 56 of the GDPR
NEW QUESTION # 26
Which of the following statements are CORRECT about records of processing'?
A It must contain contact details for the Data Protection Officer where applicable.
B It must be submitted to the Information Commissioner's Office following every Data Protection ImpactAssessment C It is mandatory for all data processors D The controller or the processor a mustmakesthe record available to the supervisory authority on request
E. It must contain contact details for the supervisory authority
- A. A. C,D, and E
- B. A, C,andD
- C. A,C,andE
- D. B, C. and D
Answer: B
Explanation:
Explanation
Article 30 of the UK GDPR3 requires both controllers and processors to maintain records of their processing activities, unless they are exempted under certain conditions. The records must contain the following information, among others:
* the name and contact details of the controller or the processor, and of any joint controller, representative or data protection officer;
* the purposes of the processing;
* the categories of data subjects and personal data;
* the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations;
* where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and the documentation of suitable safeguards;
* where possible, the envisaged time limits for erasure of the different categories of data;
* where possible, a general description of the technical and organisational security measures.
The records must be in writing, including in electronic form, and must be made available to the ICO on request. The records do not need to contain contact details of the supervisory authority, as this is not specified in Article 30. Nor do they need to be submitted to the ICO following every DPIA, as this is not required by Article 35, which only obliges the controller to consult the ICO prior to the processing if the DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk. References:
* Article 30 of the UK GDPR3
* Article 35 of the UK GDPR4
NEW QUESTION # 27
Two businesses decide to work together to sell their products by mail order Orders are made via a single online website and they each use their existing employees to administer and update each other's orders on a single order system regardless of product.
Which of the below is CORRECT of the roles of the two businesses in relation to the single order system'?
- A. They are controllers of their own information in the single order system and processors of the information they process on behalf of the other business.
- B. The businesses are controllers of their respective information, and the staff are processors of this information
- C. They are controllers of their own information contained in the single order system only
- D. They are both joint controllers of the information contained in the single order system
Answer: D
Explanation:
Explanation
The two businesses are both joint controllers of the information contained in the single order system, because they jointly determine the purposes and means of the processing. They have a shared purpose of selling their products by mail order and they agree on the means of processing by using a single online website and a single order system. Their decisions complement each other and are necessary for the processing to take place. The processing by each party is inseparable and inextricably linked. Therefore, they meet the criteria for joint controllership under the GDPR. References:
* Article 26 of the GDPR1
* Guidelines 07/2020 on the concepts of controller and processor in the GDPR2, pp. 16-24
NEW QUESTION # 28
A company based in France uses a specialist IT support business in China The two companies have signed a Data Processing Agreement.The Chinese business provides specialist IT support for the French company's digital customer experience platform No personal data is sent to China, but employees of the Chinese business access the platform on a regular basis and have access to the databases that sit behind it.Which of the following statements is CORRECT in relation to the French company's requirements to ensure compliance with the GDPR?
- A. The French company must identify and implement an appropriate transfer mechanism
- B. No personal data is being transferred, therefore no transfer mechanism is needed
- C. There is a Data Processing Agreement in place therefore no transfer mechanism is needed
- D. China provides an adequate level of protection for personal data, therefore no transfer mechanism is needed
Answer: A
Explanation:
Explanation
According to the GDPR, a transfer of personal data to a third country or an international organisation occurs when the personal data is made available to someone outside the EU and EEA, regardless of whether the data is physically sent or not. Therefore, the fact that the Chinese business accesses the platform and the databases that contain personal data of the French company's customers constitutes a transfer of personal data to China, which is a third country under the GDPR. The French company, as the controller of the personal data, must ensure that the transfer complies with the GDPR requirements and that the level of protection of the personal data is not undermined. This means that the French company must identify and implement an appropriate transfer mechanism, such as an adequacy decision, appropriate safeguards, or derogations for specific situations, as set out in Chapter V of the GDPR. A data processing agreement, although necessary to define the roles and responsibilities of the controller and the processor, is not sufficient to ensure the legality of the transfer, as it does not provide the same guarantees as the GDPR. China is not a country that has been recognised by the European Commission as providing an adequate level ofprotection for personal data, so the French company cannot rely on an adequacy decision either. References:
* Article 44 of the GDPR1
* ICO guidance on international transfers2
NEW QUESTION # 29
What does NOT have an exemption prescribed under schedule 3 of the Data Protection Act 2018?
- A. Credit checking agency data
- B. Education data, examination scripts and marks
- C. Health data
- D. Social Work Data.
Answer: A
NEW QUESTION # 30
Where a processor engages another processor ("sub-processor") to carry out processing activities on behalf of a controller, which of the following statements is CORRECT?
- A. The processor must receive prior written authorisation to use the sub-processor
- B. The processor may use the sub-processor without the written authorisation of the controller if the processing is deemed to be low risk.
- C. The processor may use the sub-processor without the written authorisation of the controller if the sub-processor signs a contract which reflects the same obligations as the contract with the controller
- D. The processor may use the sub-processor without the written authorisation of the controller if it adheres to an approved code of conduct
Answer: A
Explanation:
Explanation
Article 28(2) of UK GDPR states that where a processor engages another processor ("sub-processor") for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor shall be imposed on that other processor by way of a contract or other legal act under domestic law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of UK GDPR. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, theprocessor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. The other options are incorrect, as they do not reflect the requirements of UK GDPR for using a sub-processor. The processor cannot use a sub-processor without the written authorisation of the controller, regardless of whether it adheres to an approved code of conduct, signs a contract with the same obligations as the controller, or deems the processing to be low risk. References:
* Article 28(2) of UK GDPR1
* ICO guidance on contracts and liabilities between controllers and processors3
NEW QUESTION # 31
A UK public body has a security breach, in which the details of a hundred thousand members of the public are published What is the MAXIMUM fine that they could receive for this breach?
- A. £20 million or 2% of gross annual turnover
- B. £8.7 million or 2% of gross annual turnover
- C. £10 million or 4% of gross annual turnover
- D. £17 5 million or 4% of gross annual turnover
Answer: D
Explanation:
Explanation
The UK GDPR and the Data Protection Act 2018 set a maximum fine of £17.5 million or 4% of annual global turnover, whichever is higher, for infringements of the data protection principles, the rights of data subjects, or the rules on transfers of personal data to third countries. This is the higher maximum penalty that applies to the most serious breaches of the UK GDPR. A security breach that exposes the details of a hundred thousand members of the public would likely fall under this category, as it would compromise the confidentiality and integrity of personal data, and potentially cause significant harm and distress to the data subjects. Therefore, the maximum fine that the UK public body could receive for this breach is £17.5 million or 4% of gross annual turnover, whichever is higher. References:
* Penalties3
* GDPR Penalties & Fines4
* Three years of GDPR: the biggest fines so far5
NEW QUESTION # 32
Describe the act of processing under the authority of a controller or processor as stipulated in UK GDPR Article 29.
- A. The processor shall consult the supervisory authority prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the processor to mitigate the risk.
- B. The processor shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.
- C. Each processor and, where applicable, the processors representative shall maintain a record of all categories of processing activities earned out on behalf of a controller.
- D. A processor shall not process those data except on instructions from the controller, unless required to do so by domestic law
Answer: D
Explanation:
Explanation
Article 29 of UK GDPR states that the processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by domestic law. This means that the processor must follow the controller's directions on how to handle the personal data, and cannot use it for its own purposes or deviate from the agreed terms. The only exception is when the processor is obliged by law to process the data in a different way, for example, to comply with a court order or a legal obligation. The other options are not related to Article 29, but to other articles of UK GDPR, such as Article 25 (data protection by design and by default), Article 30 (records of processing activities), and Article 36 (prior consultation). References:
* Article 29 of UK GDPR1
* ICO guidance on controllers and processors2
NEW QUESTION # 33
Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?
- A. It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
- B. It is key to the accountability element of the GDPR.
- C. It fulfils a requirement that data protection is carried out by design and default.
- D. It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated
Answer: A
Explanation:
Explanation
A DPIA is not required to fulfil the requirement that all DPIAs are submitted to the ICO, because this is not a requirement under the GDPR. The GDPR only requires that the controller consults the ICO before carrying out processing that is likely to result in a highrisk to individuals, if the controller cannot mitigate that risk. This means that not all DPIAs need to be submitted to the ICO, only those that identify a high residual risk that cannot be reduced. The other options are valid purposes of carrying out a DPIA, as they help the controller to comply with the GDPR, ensure data protection by design and by default, and identify and mitigate the main risks to individuals' rights and freedoms. References:
* Article 35 and 36 of the GDPR3
* ICO guidance on DPIAs5
NEW QUESTION # 34
What is the basis of the accountability and data governance obligation (Article 5 (2) of the GDPR)?
- A. The controller shall appoint a DPO before carrying out large scale processing
- B. Controllers and Processors each have a responsibility to conduct legitimate interests balancing tests before processing data for direct marketing
- C. The controller shall be responsible for. and be able to demonstrate compliance with the data protection principles.
- D. Processors have overarching responsibility to ensure their processing is compliant
Answer: C
Explanation:
Explanation
Article 5(2) of the GDPR introduces the principle of accountability, which requires that the controller is responsible for, and be able to demonstrate compliance with, the data protection principles set out in Article
5(1). These principles are: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and data protection by design and by default. The controller must implement appropriate technical and organisational measures to ensure and demonstrate compliance, such as policies, procedures, records, audits, reviews, and DPIAs. The controller must also cooperate with the supervisory authority and provide any information requested by it. The other options are not the basis of the accountability and data governance obligation, although they may be related to other obligations under the GDPR. References:
* Article 5(2) of the GDPR3
* ICO guidance on accountability and governance4
NEW QUESTION # 35
Which of the following is NOT a key requirement of independent supervisory authorities?
- A. They must operate independently.
- B. They review DPIAs in cases of unmitigated high risk
- C. They must provide each other with mutual assistance
- D. Their leadership must change every four years
Answer: D
Explanation:
Explanation
Independent supervisory authorities are public authorities that supervise, through investigative and corrective powers, the application of the data protection law. They provide expert advice on data protection issues and handle complaints lodged against violations of the UK GDPR and the relevant national laws. The UK GDPR sets out the key requirements for independent supervisory authorities in Chapter VI, which include the following:
* They must operate independently and remain free from external influence, whether direct or indirect, and must neither seek nor take instructions from anybody.
* They must have adequate human, technical and financial resources to perform their tasks and exercise their powers effectively.
* They must review data protection impact assessments in cases of unmitigated high risk and provide prior consultation to controllers on such processing operations.
* They must provide each other with mutual assistance and cooperate with each other and the European Data Protection Board to ensure the consistent application of the UK GDPR across the EU.
* They must handle complaints lodged by data subjects or by bodies, organisations or associations representing them, and investigate the subject matter of the complaint to the extent appropriate.
* They must adopt binding decisions on matters concerning the application of the UK GDPR and impose effective, proportionate and dissuasive administrative fines for infringements of the UK GDPR.
The UK GDPR does not specify any fixed term for the leadership of independent supervisory authorities, nor does it require their leadership to change every four years. However, it does require that the members of the supervisory authority must be appointed by means of a transparent procedure by the parliament, the government or the head of state of the Member State concerned, and that they must act with integrity, refrain from any action incompatible with their duties and not engage in any incompatible occupation during and after their term of office. The UK GDPR also allows Member States to provide for rules regarding the establishment, appointment, duration of the term and dismissal of the head or members of the supervisory authority. References:
* UK GDPR, Chapter VI7
* ICO website, About the ICO8
NEW QUESTION # 36
......
PDP9 Dumps To Pass BCS Practitioner Exam in One Day: https://www.exams4collection.com/PDP9-latest-braindumps.html
100% Guaranteed Results PDP9 Unlimited 42 Questions: https://drive.google.com/open?id=17z-T9amcS1LAPZcSc7okQgtoC8SjzBFC
