European Data Protection Law and Regulation

Core GDPR concepts, data processing principles, lawful bases, territorial scope, transparency, and information provision obligations.

5 minutes 5 Questions

European Data Protection Law and Regulation forms the cornerstone of privacy rights across the European Union and the European Economic Area. The primary legislation governing data protection is the General Data Protection Regulation (GDPR), which came into effect on May 25, 2018, replacing the ear…

Concepts covered
Special Categories of Personal Data (Article 9)Data Processing Principles (Article 5)Lawfulness, Fairness, and TransparencyAccuracy, Storage Limitation, and IntegrityAccountability Principle (Article 5(2))Territorial and Material Scope (Article 3)Extraterritorial Reach of GDPRContract, Legal Obligation, and Vital InterestsLegitimate Interests Assessment (EDPB Guidelines 1/2024)Privacy Notices and Information ProvisionDefinition of Personal DataAnonymization and PseudonymizationPurpose Limitation and Data MinimizationConsent as Legal Basis (Article 7)Public Task and Legitimate InterestsTransparency Requirements (Articles 12-14)
Test mode:
Start practice test

CIPP/E - European Data Protection Law and Regulation Example Questions

Test your knowledge of European Data Protection Law and Regulation

Question 1

An organization collects agreement for promotional text messages by asking users to reply 'YES' to a shortcode. To stop receiving these messages, the current system requires users to log into a web portal, navigate to account settings, and uncheck a preference box. How should the team adjust this process to satisfy regulatory standards?

Correct Answer: The organization must allow users to revoke their agreement through an SMS reply equivalent to the initial opt-in method.

Under the GDPR, withdrawing consent must be as easy as giving it, meaning an SMS opt-in should be matched with an equally simple SMS opt-out.
Requiring a secondary email confirmation adds unnecessary friction. Providing a toll-free number alongside a web portal is still more burdensome than a simple text reply. Demanding a formal written request via postal service creates a severe barrier to withdrawal that violates the regulation.
The key concept tested is the requirement that withdrawing consent must be as easy as providing it under Article 7.

Question 2

A retail company wants to use legitimate interest under Article 6(1)(f) GDPR to send personalized product recommendations to existing customers via email. The company argues its commercial interest in increasing revenue is sufficient justification. A DPO reviews this under EDPB Guidelines 1/2024. The balancing test reveals that the profiling involved creates detailed behavioral profiles, customers have no prior relationship context for this processing, and no opt-out mechanism is offered. What should the DPO recommend?

Correct Answer: The legitimate interest claim likely fails because the balancing test shows the data subjects' rights and freedoms override the company's interest, given the invasive profiling and lack of safeguards

The legitimate interest basis under Article 6(1)(f) requires a three-part test: identifying a legitimate interest, establishing necessity, and conducting a balancing test weighing the controller's interest against the data subjects' rights and freedoms. Here, the balancing test fails because detailed behavioral profiling is highly invasive, customers lack reasonable expectations for this processing (no prior relationship context), and the absence of an opt-out mechanism removes a critical safeguard that could have mitigated the impact on data subjects.

Recital 47 does mention direct marketing as a possible legitimate interest, but this does not guarantee the balancing test outcome; it still must be assessed case by case. The controller's interest need not be a fundamental right under the Charter, just a genuine and lawful interest. The balancing step is never optional; it is mandatory for all legitimate interest claims.

Key concept tested: the Article 6(1)(f) balancing test and the role of safeguards, reasonable expectations, and proportionality under EDPB Guidelines 1/2024.

Question 3

Under Article 9(2)(h) GDPR, processing of health data for preventive or occupational medicine purposes requires which additional safeguard regarding the persons handling such data?

Correct Answer: Processing must be carried out by or under the responsibility of a professional subject to an obligation of professional secrecy

Article 9(2)(h) GDPR explicitly states that processing of health data for preventive or occupational medicine purposes is permitted when it is carried out by or under the responsibility of a professional who is subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies, or by another person also subject to an obligation of secrecy.

Supervision by the supervisory authority and prior authorization are not requirements specified under this provision. Oversight by a qualified medical practitioner with explicit consent conflates two separate legal bases and adds an unnecessary consent requirement. A certified DPO with specialized health data training is not a safeguard mentioned anywhere in Article 9(2)(h).

The key concept tested is the professional secrecy obligation as a specific safeguard for processing special category health data under Article 9(2)(h).

More European Data Protection Law and Regulation questions
429 questions (total)
Practice 100 questions
One session at a time, always new questions