CDPSE Impact Assessments 2 — Questions and Answers
Question 1: Under GDPR Article 35, which criterion ALONE is sufficient to trigger a mandatory Data Protection Impact Assessment?
- Processing personal data of fewer than 500 individuals
- Systematic and extensive profiling used to make significant decisions about individuals (Correct answer)
- Storing encrypted backups of employee records
- Sending marketing emails to opted-in subscribers
Correct answer: Systematic and extensive profiling used to make significant decisions about individuals
GDPR Article 35 mandates a DPIA when processing involves systematic and extensive profiling used as the basis for decisions that significantly affect individuals.
Question 2: A DPIA concludes that residual risk remains high after all mitigations are applied. What is the required next step under GDPR?
- Proceed with processing since mitigation was attempted
- Consult with the supervisory authority before proceeding (Correct answer)
- Appoint a Data Protection Officer immediately
- Anonymize all data before processing begins
Correct answer: Consult with the supervisory authority before proceeding
When residual risk remains high after mitigation, GDPR Article 36 requires mandatory prior consultation with the competent supervisory authority.
Question 3: Which element distinguishes a Privacy Impact Assessment (PIA) from a general risk assessment?
- A PIA focuses exclusively on financial risks
- A PIA specifically evaluates risks to individuals' privacy rights and freedoms (Correct answer)
- A PIA is only required for government agencies
- A PIA replaces the need for a security risk assessment
Correct answer: A PIA specifically evaluates risks to individuals' privacy rights and freedoms
A PIA specifically evaluates how a project or system affects the privacy rights and freedoms of individuals, not just organizational or financial risk.
Question 4: During a DPIA, what is the primary purpose of consulting with the Data Protection Officer (DPO)?
- To obtain legal authority to begin processing
- To seek independent advice on compliance and risk mitigation (Correct answer)
- To replace the role of the supervisory authority
- To sign off on data subject consent forms
Correct answer: To seek independent advice on compliance and risk mitigation
The DPO provides independent expert advice on whether the DPIA is conducted correctly and whether residual risks are acceptable.
Question 5: A company plans to introduce employee monitoring software that tracks keystrokes and screenshots. Which impact assessment consideration is MOST critical?
- Whether the software vendor is ISO 27001 certified
- Whether the monitoring is proportionate to the stated legitimate purpose (Correct answer)
- Whether the software operates on Windows or macOS
- Whether employees use company-owned devices
Correct answer: Whether the monitoring is proportionate to the stated legitimate purpose
Proportionality is a core privacy principle; the intrusiveness of keystroke/screenshot monitoring must be weighed against the legitimate business purpose it serves.
Question 6: In the context of a DPIA, what does 'necessity and proportionality' assessment require an organization to demonstrate?
- That data processing is technically possible and cost-effective
- That the processing is limited to what is strictly needed to achieve the specified purpose (Correct answer)
- That all data subjects have provided written consent
- That the organization has cyber liability insurance
Correct answer: That the processing is limited to what is strictly needed to achieve the specified purpose
Necessity and proportionality require showing that no less privacy-invasive means could achieve the same purpose and that data collection is not excessive.
Question 7: Which scenario would most likely require a DPIA under GDPR's 'large-scale processing' criterion?
- A single GP practice processing patient records for 2,000 local patients
- A national hospital network processing health data of patients across an entire country (Correct answer)
- A small HR team maintaining personnel files for 50 employees
- A bakery keeping a customer email list of 300 people
Correct answer: A national hospital network processing health data of patients across an entire country
GDPR's WP29 guidance identifies national-scale health data processing as a clear example of 'large-scale' that triggers a mandatory DPIA.
CDPSE Impact Assessments 2
Under GDPR Article 35, which criterion ALONE is sufficient to trigger a mandatory Data Protection Impact Assessment?