CDPPE/F Data Protection Practitioner in Education

Question 1 of 37

1. Question

If a teacher receives a Subject Access Request (SAR), what should they be trained to do?

Report it to the Information Commissioner's Office
Ask for it to be included on the agenda of the next staff meeting
Contact the requestor to discuss their request in more detail
Immediately transfer the request to the Data Protection Officer / Lead

Question 2 of 37

2. Question

Which of the following items is NOT required to be contained within the record of processing activities (ROPA) as set out in the UK GDPR?

Details of the Data Subjects
Details of staff training
The purpose of processing.
Name and contact details of any Joint Controllers.

Question 3 of 37

3. Question

Under Article 30 of UK GDPR, unless exempt, Controllers must maintain a Record of their Processing Activities (ROPA). The ROPA must contain the following information. Select all that apply:

The categories of personal data you process about people
Your organisation's name and contact details.
Any Joint Controller details (if relevant)
The details of any special categories of personal data processed

Question 4 of 37

4. Question

When you leave your desk, it is good practice to do the following Select all that apply.

Lock your PC screen using ‘Ctrl Alt Del’
Ask your colleague to keep an eye on your computer for you
Turn your monitor off
Lock any personal data in secure storage.

Question 5 of 37

5. Question

Which of the following is NOT an obligation of the Processor when processing the Personal Data on behalf of the Controller?

Keeping personal data secure.
Maintaining a ROPA (record of processing activities)
Determining the purpose of the processing.
Assisting the Controller with DPIA's and DSARs.

Question 6 of 37

6. Question

Which of the following is NOT an individual’s legal right under GDPR?

The right to correct inaccurate personal data
The right to request a copy of their personal data held by the School
The right to know how your personal data is being processed
The right to prevent personal data being shared with the Police

Question 7 of 37

7. Question

Which of the following responsibilities does the Information Commissioner’s Office (ICO) NOT have?

Conduct data protection audits
Enforcing GDPR
Issuing enforcement notices where serious breaches have occurred
Undertaking DPIA's for Controllers

Question 8 of 37

8. Question

Which Data Protection Principle ensures that the School’s Privacy Notice accurately reflects how it uses personal data?

Principle 1 Lawfulness, Fairness and Transparency
Principle 2 Purpose Limitation
Principle 4 Accuracy
Principle 6 Integrity and Confidentiality

Question 9 of 37

9. Question

A member of staff collapses and is unconscious, you share their medical information with a paramedic. Is this an unlawful and unauthorized disclosure of personal data?

Yes, we have no data sharing agreement with the NHS
Yes, the member of staff did not consent to this.
No, because the disclosure is a matter of vital interests.
No, this disclosure will be covered by the Public Task Lawful Basis.

Question 10 of 37

10. Question

Which of the following are Data Subjects? Select all that apply.

Teachers
A software company
Students
The Admissions Department

Question 11 of 37

11. Question

Which data protection principle requires you to have appropriate measures and records in place to be able to demonstrate your compliance with GDPR.

Principle 2 Lawfulness, fairness and transparency
Principle 7 Accountability
Principle 6 Integrity and Confidentiality
Principle 4 Accuracy

Question 12 of 37

12. Question

To comply with the Data Minimisation principle, when sharing information, you should… Select all that apply.

Only provide the information that is relevant to the enquiry
Share all of the information held with the requester.
Check to see if the purpose can be achieved in a less intrusive way? Ie.using anonymised or pseudonymised data?
Insist the data is anonymised prior to sharing

Question 13 of 37

13. Question

Your Principal has suggested certain staff wear “body worn cameras” to capture unruly student behaviour. What will your advice include?

Tell the Principal this would breach GDPR. It cannot go ahead.
Tell the Principal this would be necessary for the school's legitimate interests of safeguarding so it can go ahead.
Tell the Principal we should first conduct a DPIA.
Register our intention of conducting surveillance with the police.

Question 14 of 37

14. Question

The “Right to Be Forgotten” gives an individual the right to request to have their personal data…?

Restricted
Erased
Read by anyone
Amended

Question 15 of 37

15. Question

Which of the following is NOT an “Individual Right”?

Right to data portability
Right of subject access
Right to anonymity
Right to object to processing for direct marketing

Question 16 of 37

16. Question

If the School discovers a significant data breach, how long does it have to report this to the Information Commissioner’s Office?

48 hours
24 hours
12 hours
Promptly and within 72 hours

Question 17 of 37

17. Question

You are advising the Board of Directors on staff using their personal devices for work purposes. (Use Your Own Device or UYOD). Which of these statements is appropriate. Select all that apply.

You should implement a UYOD policy.
In respect of work-related personal data processed on the device, the owner of the device is a Joint Controller of the personal data with your organisation.
Your organisation remains the Controller of the work-related personal data processed on the device, regardless of who owns the device.
If there is a data breach involving the device, the owner of the device must report the breach to the ICO.

Question 18 of 37

18. Question

What is “processing” information? Select all that apply

Collecting
Sharing
Emailing
Deleting

Question 19 of 37

19. Question

How long does a Controller usually have to comply with a valid Subject Access Request

40 calendar days
One calendar month
20 working days
A reasonable amount of time

Question 20 of 37

20. Question

Which of the following statements is true of a Processor? Select all that apply.

They must comply with Data Protection legislation
They must process the personal data on the basis of the Controller’s instructions
They must comply with the contract between them and the Controller under Article 28
They can repurpose the personal data for their own purposes providing it is in pseudonymised form

Question 21 of 37

21. Question

Which of the following is NOT a necessary component of legally valid consent under UK GDPR?

Freely given
Evidenced
The right to withdraw consent at anytime
In writing

Question 22 of 37

22. Question

Which of the following are lawful bases under Article 6 UK GDPR, for sharing personal data? Select all that apply.

legal obligation
The information has been shared in the past therefore there is a history of established data sharing
Consent of the data subject
Vital Interests

Question 23 of 37

23. Question

A member of staff uses her access permissions to access the HR system and discovers that a colleague junior to her receives more in remuneration and benefits. She uses this information to request a pay rise. Which of the statements is most likely to be TRUE.

The member of staff may have committed an offence of knowingly obtaining personal data without the consent of the Controller.
The member of staff is commiting the offence of producing a "relevant record" for employment purposes.
The member of staff has become a Controller of the personal data held on the HR database as she is processing it for her own purposes.
The employer is in breach of the data minimisation principle because it is allowing personal data to be processed for purposes which are unnecessary.

Question 24 of 37

24. Question

Which of the following would NOT fall under the jurisdiction of GDPR?

An English company selling goods to people in Scotland.
A UK company selling goods only to US citzens
A US company selling goods to UK citizens residing in the U.S
A US company selling goods to Americans residing in the UK.

Question 25 of 37

25. Question

An Appropriate Policy Document (APD) is:

a statutory policy which all Controllers are required to have in place when processing special categories of personal data regardless of the conditions under which they are being processed under Article 9 UK GDPR and DPA 2018
a statutory policy which sets out your compliance measures for handling special category personal data. It is required when processing special category personal data under certain conditions only under Article 9 of UK GDPR and the DPA 2018.
a policy which describes your appropriate use of personal data under GDPR
a statutory policy which public authorities are required to have in place when processing special categories of personal data regardless of the conditions under which they are being processed under Article 9 UK GDPR and DPA 2018

Question 26 of 37

26. Question

What might happen if a Controller who is not exempt, fails to pay the annual Controller fee?

The personal data concerned can be seized.
You must pay an extra fee.
You must write a letter of apology.
You can be prosecuted by the Information Commissioner.

Question 27 of 37

27. Question

Finish the following sentence. A Controller….

… need not worry about legal basis, the processor takes care of this.
..determines the purpose and manner of processing personal data.
… follows the instructions of the processor.
… can insist that SARS are managed by the ICO.

Question 28 of 37

28. Question

Select the phrase that is the most appropriate

Encryption is mandatory under UK GDPR regardless of the nature, scope, context, purposes of processing and the risks posed to individuals.
Encryption is not mandatory under GDPR but may be an appropriate technical measure to take depending on the nature, scope, context, purposes of processing and the risks posed to individuals.
Encryption is a technical measure that must be considered by Controllers but not Processors of personal data
Encryption of personal data removes all of the security risks associated with the processing of personal data and should therefore be deployed in all cases and on all portable devices used to store , process or transfer personal data.

Question 29 of 37

29. Question

Which of the following is NOT special category personal data under UK GDPR?

A teachers religious beliefs.
A cleaners trade union membership.
A member of staff's sickness record
A job applicant's record of criminal convictions

Question 30 of 37

30. Question

If your school is required to disclose your salary details to HMRC, which legal basis would they likely to be relying on?

legal obligation
public task
vital interest
consent

Question 31 of 37

31. Question

Under UK GDPR which of the following organisations are NOT required to appoint a Data Protection Officer?

An organisation whose core activities consist of large scale processing of special categories of data.
A public authority or body.
An organisation whose core activities require large scale , regular and systematic monitoring or individuals.
An organisation whose core activities involve the processing of personal data that is likely to impact the interests or fundamental rights and freedoms of data subjects, in particular where the data subject is a child.

Question 32 of 37

32. Question

Who is responsible for monitoring compliance with a public authority school’s Data Protection Policy?

Headteacher
Head of IT
Data Protection Officer
All School staff

Question 33 of 37

33. Question

Which of the following are permitted ways under UK GDPR, to transfer personal data outside the UK? Select all that apply.

Destination Country is a member of United Nations
Binding Corporate Rules
Your Processor transfers the same type of data for other companies.
Standard Contract Clauses

Question 34 of 37

34. Question

The right of subject access under Article 15 of UK GDPR gives a data subject the right to: Select all that apply:

Confirmation as to whether the Controller is processing their personal data
A copy of their personal data.
Supplementary information relating to the way in which their personal data is being processed.
A copy of the organisation's current privacy notice.

Question 35 of 37

35. Question

Which of the following ensures the secure destruction of records containing personal data? Select all that apply

Placing them in a recycling bin
Using an authorised shredding machine
Placing them in the School Archives
Using confidential destruction bags and ensuring the waste is confidentially destroyed by an approved shredding company

Question 36 of 37

36. Question

A college suffers a serious cyber attack on its systems. Under what circumstances must it notify affected data subjects ?

The breach is likely to result in a risk to the rights and freedoms of individuals
The breach is likely to result in a high risk to the rights and freedoms of individuals
The breach involved special category personal data relating to the data subjects
You do not need to notify affected data subjects. The breach was due to a failure to take technical security measures by your IT service provider (your Processor). Therefore, it is your Processor's responsibility to notify data subjects.

Question 37 of 37

37. Question

If a Subject Access Request is complex, by how long may you extend the 1 calendar month period for compliance by ?

a further 3 months
a further 2 months
a further 1 month
40 days