PECB GDPR Practice Exams
Last updated on Oct 22,2026- Exam Code: GDPR
- Exam Name: PECB Certified Data Protection Officer
- Certification Provider: PECB
- Latest update: Oct 22,2026
Scenario 4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients’ heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc’s and Unty’s customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO’s advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc’s and Unty’s clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Question:
Question:
Is the transfer of data from Berc to Unty in compliance with GDPR?
- A . Yes, Berc can transfer data to Unty because Switzerland provides a level of data protection that is "essentially equivalent” to that of the EU.
- B . Yes, Berc can transfer data to Unty because they collected data for the same purpose.
- C . No, Berc cannot transfer data to a company in Switzerland unless authorization from the
supervisory authority in France is obtained. - D . No, Berc must conduct a new DPIA before transferring data to Switzerland.
A
Explanation:
Under Article 45 of GDPR, data transfers to third countries are lawful if the European Commission has adopted an adequacy decision, meaning the country offers equivalent protection to GDPR. Switzerland has such an adequacy decision, making Berc’s transfer lawful.
Option A is correct because Switzerland meets GDPR adequacy standards.
Option B is incorrect because having the same purpose does not automatically make the transfer lawful.
Option C is incorrect because no supervisory authorization is needed when an adequacy decision exists.
Option D is incorrect because a DPIA is not required for a GDPR-compliant transfer.
Reference: GDPR Article 45(1) (Adequacy decisions for third countries)
European Commission Decision on Switzerland’s adequacy
Scenario:
An organization conducted an online survey to gather opinions on global warming. The survey collected personal data, including age, nationality, gender, and city of residence.
Question:
What should be considered when identifying this processing activity?
- A . Information on the personal data collected and its sensitivity.
- B . Information about how the data is processed.
- C . A description of data subjects and the categories of personal data collected.
- D . The survey platform’s technical security measures.
C
Explanation:
Under Article 30 of GDPR, controllers must maintain a record of processing activities, including the categories of data subjects and types of personal data collected.
Option C is correct because describing data subjects and personal data categories is fundamental in processing documentation.
Option A is incorrect because sensitivity alone does not define processing obligations.
Option B is incorrect because processing methods are important but do not solely define processing activities.
Option D is incorrect because technical security measures are relevant but are not part of defining processing activities.
Reference: GDPR Article 30(1)(b) (Controllers must document categories of data subjects and personal data processed)
Recital 82 (Proper record-keeping of processing activities)
Scenario 9:
Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers’ data. Data collected by Soin includes customer’s ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin’s data processing activities are built based on customer’s consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin. However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin’s data processing activities. The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices. The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin’s clients claiming that they do not have access in their personal data stored by Soin. Soin’s Customer Service Department answered the emails saying that, based on Soin’s policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure
which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions. Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following Question:
Soin’s DPO conducted an internal data protection audit. Is this acceptable?
- A . No, the role of the DPO is to only assist the company in conducting an internal data protection audit
- B . No, only the supervisory authority is responsible for conducting investigations in the form of internal data protection audits
- C . Yes, the DPO can conduct an internal data protection audit as part of monitoring compliance
C
Explanation:
Under GDPR Article 39(1)(b), the DPO is responsible for monitoring compliance with GDPR, including conducting internal audits. The DPO’s role includes overseeing data protection policies, raising awareness, and ensuring adherence to regulations. The internal audit conducted by the DPO at Soin aligns with these responsibilities. However, while the DPO can conduct internal audits, the supervisory authority is responsible for external investigations and enforcement actions under GDPR Article 58.
Scenario 9:
Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers’ data. Data collected by Soin includes customer’s ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin’s data processing activities are built based on customer’s consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin. However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin’s data processing activities. The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices. The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin’s clients claiming that they do not have access in their personal data stored by Soin. Soin’s Customer Service Department answered the emails saying that, based on Soin’s policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure
which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions. Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following Question:
Soin’s DPO conducted an internal data protection audit. Is this acceptable?
- A . No, the role of the DPO is to only assist the company in conducting an internal data protection audit
- B . No, only the supervisory authority is responsible for conducting investigations in the form of internal data protection audits
- C . Yes, the DPO can conduct an internal data protection audit as part of monitoring compliance
C
Explanation:
Under GDPR Article 39(1)(b), the DPO is responsible for monitoring compliance with GDPR, including conducting internal audits. The DPO’s role includes overseeing data protection policies, raising awareness, and ensuring adherence to regulations. The internal audit conducted by the DPO at Soin aligns with these responsibilities. However, while the DPO can conduct internal audits, the supervisory authority is responsible for external investigations and enforcement actions under GDPR Article 58.
Scenario 8:
MA store is an online clothing retailer founded in 2010. They provide quality products at a reasonable cost. One thing that differentiates MA store from other online shopping sites is their excellent customer service.
MA store follows a customer-centered business approach. They have created a user-friendly website with well-organized content that is accessible to everyone. Through innovative ideas and services, MA store offers a seamless user experience for visitors while also attracting new customers. When
visiting the website, customers can filter their search results by price, size, customer reviews, and other features. One of MA store’s strategies for providing, personalizing, and improving its products is data analytics. MA store tracks and analyzes the user actions on its website so it can create customized experience for visitors.
In order to understand their target audience, MA store analyzes shopping preferences of its customers based on their purchase history. The purchase history includes the product that was bought, shipping updates, and payment details. Clients’ personal data and other information related to MA store products included in the purchase history are stored in separate databases. Personal information, such as clients’ address or payment details, are encrypted using a public key. When analyzing the shopping preferences of customers, employees access only the information about the product while the identity of customers is removed from the data set and replaced with a common value, ensuring that customer identities are protected and cannot be retrieved.
Last year, MA store announced that they suffered a personal data breach where personal data of clients were leaked. The personal data breach was caused by an SQL injection attack which targeted MA store’s web application. The SQL injection was successful since no parameterized queries were used.
Based on this scenario, answer the following Question:
According to scenario 8, by storing clients’ information in separate databases, MA store used a:
- A . Data protection by design strategy
- B . Data protection by default technology
- C . Pseudonymization method
A
Explanation:
Separating databases for different types of data aligns with the principle of Data Protection by Design and by Default under Article 25 of GDPR. By structuring data storage in a way that limits access and minimizes exposure, MA Store is proactively implementing security measures that prevent
unauthorized access and mitigate risks in case of a breach. This approach supports the confidentiality, integrity, and availability of personal data as required by GDPR.
Scenario 4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required
the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients’ heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc’s and Unty’s customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO’s advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc’s and Unty’s clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Question:
Question:
Based on scenario 4, Berc followed the DPO’s advice for outsourcing an international marketing company in the absence of an adequacy decision. Is the DPO responsible for evaluating this case?
- A . Yes, the DPO should evaluate cases where an adequacy decision is absent.
- B . Yes, the DPO takes the final decision on transferring personal data to an international company in the absence of an adequacy decision.
- C . No, the controller or processor should evaluate cases when the adequacy decision is absent.
- D . No, because the marketing company operates under the same data protection rules as Berc.
C
Explanation:
Under Article 44 of GDPR, the controller (Berc) is responsible for ensuring lawful data transfers. The DPO advises on compliance but does not make final decisions on data transfers.
Option C is correct because the controller (Berc) must evaluate the legality of the transfer.
Option A is incorrect because DPOs provide advice but do not evaluate data transfer legality.
Option B is incorrect because DPOs do not have executive decision-making authority.
Option D is incorrect because data protection rules vary by jurisdiction, making this assumption incorrect.
Reference: GDPR Article 44 (General principle for transfers)
GDPR Article 39(1)(a) (DPO’s advisory role)
Scenario:
A clinical research organization collects and processes sensitive personal data of individuals for medical research purposes. The data is encrypted and stored in a central database using a one-way hashing function (bcrypt). The organization conducted a risk assessment to identify and mitigate risks.
Question:
Should a DPIA be conducted in this case?
- A . Yes, a DPIA should be conducted when sensitive personal data of vulnerable persons is collected, based on the identified risk from the risk assessment.
- B . No, because the personal data is encrypted.
- C . No, because the organization has already conducted a risk assessment.
- D . Yes, but only if the data is retained for more than five years.
A
Explanation:
Under Article 35(3)(b) of GDPR, a DPIA is required for large-scale processing of sensitive data, including medical research on vulnerable individuals.
Option A is correct because medical data and research involving vulnerable individuals require a DPIA.
Option B is incorrect because encryption does not eliminate the need for a DPIA if the processing poses high risks.
Option C is incorrect because a general risk assessment does not replace a DPIA under Article 35.
Option D is incorrect because retention period is not a deciding factor for DPIA necessity.
Reference: GDPR Article 35(3)(b) (DPIA for special category data)
Recital 91 (Risks to fundamental rights require DPIAs)
Question:
Which of the following options is the DPO’s responsibility when processing personal data related to criminal convictions is carried out by an official authority?
- A . Determining the location where sensitive data may be processed.
- B . Assessing the necessity of knowing a data subject’s identity.
- C . Ensuring compliance with any legal requirements of Member States.
- D . Approving all security measures for processing this data.
C
Explanation:
Under Article 39(1)(b) of GDPR, the DPO monitors compliance with GDPR and other applicable laws, including Member State laws on criminal conviction data.
Option C is correct because DPOs must ensure processing aligns with national legal requirements.
Option A is incorrect because determining processing locations is a technical decision, not a DPO responsibility.
Option B is incorrect because DPOs do not assess the necessity of identity disclosure.
Option D is incorrect because approving security measures is the responsibility of controllers and processors, not the DPO.
Reference: GDPR Article 39(1)(b) (DPO’s role in ensuring legal compliance)
Recital 97 (DPO responsibilities in public and private sectors)
Question:
All the statements below regarding the lawfulness of processing are correct, except:
- A . Processing is necessary for the performance of a contract to which the data subject is a party.
- B . Processing is necessary to obtain consent from the data subject.
- C . Processing is necessary to protect the vital interests of the data subject or another natural person.
- D . Processing is necessary for the legitimate interests pursued by the controller, except where overridden by the interests or fundamental rights of the data subject.
B
Explanation:
Under Article 6 of GDPR, there are six legal bases for data processing. Consent is only one of them, and processing is not always dependent on obtaining consent.
Option B is correct because GDPR does not require consent for all processing activities; processing can also be based on contractual necessity, legal obligations, vital interests, public tasks, or legitimate interests.
Option A is incorrect because contractual necessity is a valid legal basis for processing.
Option C is incorrect because vital interests (e.g., processing in medical emergencies) are a valid legal basis.
Option D is incorrect because legitimate interests can justify processing, provided they do not override the rights of data subjects.
Reference: GDPR Article 6(1) (Lawfulness of processing)
Recital 40 (Processing should be lawful and justified)
Scenario 9:
Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers’ data. Data collected by Soin includes customer’s ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin’s data processing activities are built based on customer’s consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin. However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin’s data processing activities. The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices. The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin’s clients claiming that they do not have access in their personal data stored by Soin. Soin’s Customer Service Department answered the emails saying that, based on Soin’s policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions. Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following Question:
Can the DPO appointed by Soin carry out the data protection external audit requested by the supervisory authority?
- A . No, data protection external audits should be conducted by independent auditors who are not part of the company being audited
- B . Yes, data protection external audits should be conducted by auditors contracted by Soin who can be employees of the company
- C . Yes, Soin’s DPO is allowed to conduct a data protection external audit but only if requested by the supervisory authority
A
Explanation:
GDPR Article 58(1) gives supervisory authorities the power to conduct external audits, which must be independent and unbiased. A company’s internal DPO cannot conduct an external audit, as this would pose a conflict of interest (Recital 97). External audits should be conducted by supervisory authorities or third-party auditors, ensuring objectivity.