PECB GDPR Practice Exams
Last updated on Oct 21,2026- Exam Code: GDPR
- Exam Name: PECB Certified Data Protection Officer
- Certification Provider: PECB
- Latest update: Oct 21,2026
Scenario 1:
MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients’ needs.
Patients that schedule an appointment in MED’s medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic data. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED’s doctors. Medical data of patients, including children, are stored in the database of MED’s health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients’ data through the application and can add information as needed.
Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients’ requests to stop data processing are rejected. This decision was made by MED’s top management to retain the information of everyone registered in their databases.
The company also shares medical data with InsHealth, a health insurance company. MED’s data helps InsHealth create health insurance plans that meet the needs of individuals and families.
MED believes that it is its responsibility to ensure the security and accuracy of patients’ personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.
Question:
Considering the nature of data processing activities described in scenario 1, is GDPR applicable to MED?
- A . Yes, GDPR is applicable to MED due to its processing activities involving personal information.
- B . Yes, MED’s use of cloud-based software to store and process health-related information necessitates compliance with GDPR’s data protection requirements.
- C . No, MED’s activities include healthcare services within one of the four EFTA states, which do not fall under the scope of GDPR.
- D . No, because MED operates only in Norway, and GDPR does not apply to domestic processing.
A
Explanation:
GDPR applies to any organization that processes personal data of individuals within the European Economic Area (EEA), regardless of the organization’s location. Since MED is based in Norway, which is an EEA country, and processes personal health data, it must comply with GDPR.
Option A is correct because GDPR applies to all controllers and processors within the EEA.
Option B is misleading because while cloud-based software is relevant, the primary reason GDPR applies is MED’s processing of personal data.
Option C is incorrect because EFTA states (including Norway) are subject to GDPR.
Option D is incorrect because GDPR applies to all personal data processing in the EEA.
Reference: GDPR Article 3 (Territorial Scope)
Recital 22 (GDPR applies to EEA countries)
Question:
To evaluate the effectiveness of communication, the DPO of Company ABC reviewed the accuracy and relevance of the information provided to customers regarding personal data processing.
Is this a good practice under GDPR?
- A . Yes, when evaluating the effectiveness of communication, the DPO should consider the accuracy and relevance of the information provided to concerned parties.
- B . No, the effectiveness of communication cannot be evaluated through the evaluation of the accuracy and relevance of information provided to customers.
- C . No, the DPO is not responsible for evaluating the effectiveness of communication with customers.
- D . Yes, but only if the company’s supervisory authority requests it.
A
Explanation:
Under Article 39(1)(a) of GDPR, the DPO is responsible for monitoring GDPR compliance, including ensuring transparency in communication with data subjects. This includes verifying that information about data processing is accurate and relevant.
Option A is correct because GDPR mandates that data subjects receive clear and accurate information about their personal data processing.
Option B is incorrect because accuracy and relevance are key indicators of effective communication under GDPR.
Option C is incorrect because evaluating data protection communication is part of the DPO’s compliance role.
Option D is incorrect because supervisory authority approval is not required for the DPO to conduct such evaluations.
Reference: GDPR Article 39(1)(a) (DPO’s role in monitoring compliance)
GDPR Article 12(1) (Obligation for transparent and clear communication)
Scenario 5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond’s experts analyze candidates’ profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond’s clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond’s databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Question:
Question:
Based on scenario 5, the DPO reports directly to Recpond’s top management. Is this in alignment with GDPR requirements?
- A . Yes, Article 38 of the GDPR requires that the DPO reports directly to the highest management level of the controller.
- B . No, Article 38 of the GDPR requires that the DPO reports directly to the supervisory authority to ensure independence in performing their tasks.
- C . Yes, based on GDPR, the controller may choose any reporting structure for the DPO, including top and middle management.
- D . No, DPOs should report directly to department heads, not top management.
A
Explanation:
Under Article 38(3) of GDPR, the DPO must report directly to the highest level of management to ensure independence and avoid interference in their tasks.
Option A is correct because GDPR requires direct reporting to top management.
Option B is incorrect because the DPO does not report to the supervisory authority, but they can liaise with it.
Option C is incorrect because GDPR does not allow reporting to middle management.
Option D is incorrect because department heads cannot oversee the DPO’s work, ensuring they remain free from conflict of interest.
Reference: GDPR Article 38(3) (DPO must report to highest management)
Recital 97 (DPO’s independence and protection from undue influence)
Scenario:
Pinky, a retail company, received a request from a data subject to identify which purchases they had made at different physical store locations. However, Pinky does not link purchase records to customer identities, since purchases do not require account creation.
Question:
Should Pinky process additional information from customers in order to identify the data subject as requested?
- A . Yes, Pinky is required to maintain, acquire, or process additional information in order to identify the data subject.
- B . Yes, Pinky is required to process additional information for the purpose of exercising the data subject’s rights covered in Articles 15-21 of GDPR.
- C . No, Pinky is not required to process additional information, since the processing of personal data in this case does not require Pinky to identify the data subject.
- D . No, but Pinky must ask the data subject to provide further evidence proving their identity.
C
Explanation:
Under Article 11(1) of GDPR, controllers are not required to process additional data for the sole purpose of identifying data subjects if such identification is not needed for processing.
Option C is correct because Pinky does not store identifiable purchase data, so it is not required to create additional records.
Option A and B are incorrect because GDPR does not obligate controllers to process additional data if identification is unnecessary.
Option D is incorrect because Pinky cannot require additional information when it does not have a basis to process identity-linked data.
Reference: GDPR Article 11(1) (Controllers are not required to process extra data for identification)
Recital 57 (Data controllers should avoid collecting unnecessary identity data)
Scenario:
ChatBubble is a software company that stores personal data, including usernames, emails, and passwords. Last month, an attacker gained access to ChatBubble’s system, but the personal data was encrypted, preventing unauthorized access.
Question:
Should the data subjects be notified in this case?
- A . Yes, the company shall communicate all incidents regarding personal data to the data subjects.
- B . No, the company is not required to notify data subjects about a data breach that affects a large
number of individuals. - C . No, the company is not required to notify data subjects when the personal data is protected with appropriate technical and organizational measures.
- D . Yes, but only if the supervisory authority explicitly requests notification.
C
Explanation:
Under Article 34(3)(a) of GDPR, if personal data is encrypted or otherwise protected, notification to data subjects is not required unless the risk is high.
Option C is correct because encryption renders the data unintelligible to unauthorized parties, reducing risk.
Option A is incorrect because not all breaches require data subject notification―only those posing high risks.
Option B is incorrect because the number of affected individuals does not determine notification requirements.
Option D is incorrect because notification is based on risk assessment, not supervisory authority requests alone.
Reference: GDPR Article 34(3)(a) (No notification required if encryption makes data inaccessible)
Recital 86 (Notification is necessary only if data loss poses a significant risk)
Which of the following scenarios does NOT require conducting a DPIA?
- A . When an organization processes data to comply with legal obligations under applicable Union law.
- B . When a hospital collects and processes genetic and health data of its patients.
- C . When an organization collects public social media profiles for ad personalization.
- D . When an organization installs AI-driven video analytics to track employees’ work patterns.
A
Explanation:
Under Article 35(1) of GDPR, a DPIA is not required when processing is based on a legal obligation under EU or national law.
Option A is correct because legal obligations provide a lawful basis for processing, making DPIAs unnecessary unless explicitly required by law.
Option B is incorrect because health and genetic data are special categories of data, requiring a DPIA under Article 35(3)(b).
Option C is incorrect because profiling and behavioral analysis require a DPIA, as per Article 35(3)(a).
Option D is incorrect because workplace surveillance with AI requires a DPIA, as it involves automated monitoring.
Reference: GDPR Article 35(1) (DPIA requirement for high-risk processing)
Recital 91 (Health data and large-scale profiling require DPIAs)
Scenario:
An organization has been using a storage transfer service to import market-sensitive data, including email addresses and contact details, into a cloud storage system. This change has affected the registration process and has helped the organization appropriately collect and store data.
Question:
Based on this scenario, what should the DPO monitor in the data processing register?
- A . Whether the organization has obtained consent from the data subjects for this change.
- B . Whether the changes have been reflected in the data processing registers.
- C . Whether the organization has identified storage transfer service’s technical and organizational measures for protection of personal data.
- D . Whether the organization has notified the supervisory authority about the change in storage methods.
B
Explanation:
Under Article 30 of GDPR, controllers and processors must maintain a record of processing activities (ROPA). Whenever changes occur in the way personal data is processed (such as a transfer to cloud storage), the DPO must ensure these changes are recorded in the processing register.
Option B is correct because the DPO must ensure the data processing register is updated to reflect the new storage method.
Option A is incorrect because storage changes do not require new consent unless the purpose of processing has changed.
Option C is incorrect because while assessing security measures is important, it is not the primary duty related to the data processing register.
Option D is incorrect because not all processing changes require notifying the supervisory authority unless they introduce high risks without proper safeguards.
Reference: GDPR Article 30(1)(g) (Controllers must maintain updated processing records)
Recital 82 (Controllers should document changes in processing activities)
Scenario:
Socian is a software used to collect medical records of patients, including name, date of birth, social security number, and other personal data. The system stores data on a secure server with multi-layered security.
An organization using Socian for six months wants to ensure that its processing activities comply with GDPR. The DPO advised creating a list of processing activities related to Socian.
Question:
What should be included in the processing activities registers?
- A . The severity of the risks to the rights and freedoms of data subjects.
- B . How the supervisory authority is notified in case of a personal data breach.
- C . The personal data protection techniques used.
- D . A detailed list of every individual who accessed the data.
C
Explanation:
Under Article 30 of GDPR, organizations must document security measures used to protect personal data, including pseudonymization, encryption, and access controls.
Option C is correct because documenting protection techniques is required in the processing activity register.
Option A is incorrect because risk severity assessments are part of DPIAs, not processing registers.
Option B is incorrect because breach notification procedures are handled separately under Article 33.
Option D is incorrect because while access logs are important, they are not required in the processing activity register.
Reference: GDPR Article 30(1)(g) (Security measures must be documented)
Recital 82 (Accountability requires detailed processing records)
Scenario 4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients’ heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc’s and Unty’s customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO’s advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc’s and Unty’s clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Question:
Question:
Based on scenario 4, Berc shared personal information of its clients with an international marketing company even though an adequacy decision was absent.
Which of the following is a valid reason to do so?
- A . The transfer of data does not depend on the adoption of an adequacy decision by the country where the company is located.
- B . Authorization for data transfer from Berc’s Chief Information Security Officer (CISO) is obtained.
- C . The controller or processor provides appropriate safeguards for data protection.
- D . The marketing company’s reputation ensures compliance with data protection standards.
C
Explanation:
Under Article 46 of GDPR, in the absence of an adequacy decision, controllers can transfer data only if appropriate safeguards (e.g., Standard Contractual Clauses, Binding Corporate Rules) are in place.
Option C is correct because safeguards such as SCCs allow data transfers when no adequacy decision exists.
Option A is incorrect because adequacy decisions are a legal requirement, not optional.
Option B is incorrect because a CISO cannot authorize GDPR data transfers.
Option D is incorrect because reputation does not ensure GDPR compliance.
Reference: GDPR Article 46(1) (Appropriate safeguards for data transfers)
Recital 108 (Legally binding commitments for data protection)
An organization suffered a personal data breach. The attackers gained access to their database through a user account that had unlimited access to data.
What should the DPO advise the organization to do in order to prevent the recurrence of similar scenarios?
- A . Review if the access control system allows the creation, approval, review, and deletion of user accounts
- B . Use cloud computing services to mitigate the risk of personal data breaches
- C . Create and use shared accounts for several users in order to minimize the number of user accounts
A
Explanation:
GDPR Article 32(1)(b) emphasizes implementing access controls to ensure data security. Reviewing and restricting account permissions using the principle of least privilege (PoLP) helps prevent unauthorized access. Shared accounts (option C) increase security risks, and using cloud computing (option B) does not directly address access control vulnerabilities.