Exin Updated PDPF Exam Questions and Answers by ianis

An approach that implements data protection from the start. Correct. This is a correct description. (Literature: A, Chapter 8; GDPR Article 25(1))

An indication of timeframes if processing relates to erasure. Incorrect. This is a description of a data protection impact assessment (DPIA).

Data may only be collected for explicit and legitimate purposes. Incorrect. This is a description of measures taken to comply with the principle of purpose limitation.

Not holding more data than is strictly required for processing. Incorrect. This is a description of procedures to comply with the principle of data minimization.

The lost reports did not contain personal data, in this case GDPR is not applicable and is a security incident.

Important

A data breach is whenever something that has not been planned with personal data happens, be it improper processing, improper sharing, loss of data, deletion, etc. In other words, personal data must be used for a specific purpose, respecting the life cycle of the same (from collection to exclusion), any situation that escapes this cycle must be reported as a data breach.

Article 57 legislates on the Responsibilities of the Supervisory Authority. In paragraph 1, item “a” says: “monitor and enforce the application of this Regulation”.