European Data Processing

Data subject rights, controller-processor relationships, security measures, and data breach notification.

5 minutes 5 Questions

European Data Processing refers to the handling, management, and manipulation of personal data within the framework of European data protection laws, primarily governed by the General Data Protection Regulation (GDPR). Data processing encompasses any operation performed on personal data, whether au…

Concepts covered
Right to Data Portability (Article 20)Right to Object (Article 21)Right to Erasure (Article 17)Right to Restriction of Processing (Article 18)Right to Rectification (Article 16)Controller and Processor Roles and ResponsibilitiesTechnical and Organizational Security Measures (Article 32)Privacy and Security Incident ResponseRight of Access (Article 15)Automated Decision-Making and Profiling (Article 22)Processor and Sub-Processor Obligations (EDPB Opinion 22/2024)Risk-Based Approach to Data SecurityData Breach Notification (Articles 33-34)
Test mode:
Start practice test

CIPP/E - European Data Processing Example Questions

Test your knowledge of European Data Processing

Question 1

A company acts as a processor for several controllers. During an internal audit, a new employee asks which key document, according to EDPB Opinion 22/2024, defines the scope and conditions under which a processor must operate when handling personal data. Which document is the employee referring to?

Correct Answer: The data processing agreement between the controller and the processor

Under EDPB Opinion 22/2024 and Article 28 GDPR, the data processing agreement (DPA) between the controller and the processor is the key document that defines the scope, purposes, and conditions under which the processor must operate when handling personal data on behalf of the controller.

The processor's own internal data protection policy is a self-governing document that does not legally bind the processor to a specific controller's instructions. Sub-processor binding corporate rules relate to intra-group international transfers, not the controller-processor relationship. A DPIA is a risk assessment tool conducted by the controller, not a document governing the processor's operational scope.

The key concept tested is the role of Article 28 data processing agreements in defining processor obligations.

Question 2

Under Article 28 of the General Data Protection Regulation, which specific element is required to be stipulated in a written contract between a controller and a processor?

Correct Answer: The nature and purpose of the processing, the types of personal data, and categories of data subjects.

Article 28 strictly mandates that controller-processor contracts explicitly define the subject matter, duration, nature, and purpose of the processing, as well as the types of personal data and categories of data subjects.
Commercial rationales and financial liabilities are general business terms rather than strict GDPR mandates. Specifying the exact technological framework is not required provided appropriate technical and organizational measures are implemented. Details regarding explicit consent mechanisms are the responsibility of the controller rather than a mandatory contractual stipulation for the processor.
The key concept tested is the mandatory contractual elements required between controllers and processors under GDPR Article 28.

Question 3

Under Article 30 of the GDPR, what specific record-keeping duty applies to a data processor?

Correct Answer: Maintaining a register of all categories of processing activities carried out on behalf of each controller.

Article 30 explicitly requires data processors to maintain a record of all categories of processing activities carried out on behalf of a controller.
Documenting consent mechanisms is incorrect because controllers manage consent, and authorities do not assign retention schedules. Tracking legal bases and legitimate interests is strictly a controller obligation rather than a processor duty. Keeping an inventory of automated decision-making logic relates to controller transparency and profiling rules, not processor record-keeping.
Key concept: Data processor record-keeping obligations under Article 30.

More European Data Processing questions
348 questions (total)
Practice 100 questions
One session at a time, always new questions