CIPP-E Gdpr Practice Questions

If a French controller has a car-sharing app available only in Morocco, Algeria and Tunisia, but the data processing activities are carried out by the appointed processor in Spain, the GDPR will apply to the processing of the personal data so long as?

• AA. The individuals are European citizens or residents.
• BB. The data processing activities are in Spain.
• CC. The data controller is in France.
• DD. The EU individuals are targeted.

To which of the following parties does the territorial scope of the GDPR NOT apply?

• AA. All member countries of the European Economic Area.
• BB. All member countries party to the Treaty of Lisbon.
• CC. All member countries party to the Paris Agreement.
• DD. All member countries of the European Union.

Which of the following entities would most likely be exempt from complying with the GDPR?

• AA. A South American company that regularly collects European customers’ personal data.
• BB. A company that stores all customer data in Australia and is headquartered in a European Union (EU) member state.
• CC. A Chinese company that has opened a satellite office in a European Union (EU) member state to service European customers.
• DD. A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.

Under the GDPR, which of the following is true in regard to adequacy decisions involving cross-border transfers?

• AA. The European Commission can adopt an adequacy decision for individual companies.
• BB. The European Commission can adopt, repeal or amend an existing adequacy decision.
• CC. EU member states are vested with the power to accept or reject a European Commission adequacy decision.
• DD. To be considered as adequate, third countries must implement the EU General Data Protection Regulation into their national legislation.