GDPR Exam Dumps : PECB Certified Data Protection Officer

UnderArticle 34(3)(a) of GDPR, if personal datais encrypted or otherwise protected, notification to data subjectsis not requiredunless the risk is high.

Option C is correctbecauseencryption renders the data unintelligible to unauthorized parties, reducing risk.

Option A is incorrectbecausenot all breaches require data subject notification—only those posing high risks.

Option B is incorrectbecausethe number of affected individuals does not determine notification requirements.

Option D is incorrectbecausenotification is based on risk assessment, not supervisory authority requests alone.

References:

GDPR Article 34(3)(a)(No notification required if encryption makes data inaccessible)

Recital 86(Notification is necessary only if data loss poses a significant risk)

UnderArticle 35(3)(b) of GDPR, aDPIA is required for large-scale processing of sensitive data, includingmedical research on vulnerable individuals.

Option A is correctbecausemedical data and research involving vulnerable individuals require a DPIA.

Option B is incorrectbecauseencryption does not eliminate the need for a DPIA if the processing poses high risks.

Option C is incorrectbecausea general risk assessment does not replace a DPIAunderArticle 35.

Option D is incorrectbecauseretention period is not a deciding factor for DPIA necessity.

References:

GDPR Article 35(3)(b)(DPIA for special category data)

Recital 91(Risks to fundamental rights require DPIAs)

UnderArticle 30 of GDPR, controllers and processorsmust maintain a record of processing activities (ROPA). Whenever changes occurin the way personal data is processed(such as a transfer to cloud storage), theDPO must ensure these changes are recorded in the processing register.

Option B is correctbecause theDPO must ensure the data processing register is updated to reflect the new storage method.

Option A is incorrectbecausestorage changes do not require new consent unless the purpose of processing has changed.

Option C is incorrectbecause whileassessing security measures is important, it is not theprimary dutyrelated to the data processing register.

Option D is incorrectbecausenot all processing changes require notifying the supervisory authorityunless they introduce high riskswithout proper safeguards.

References:

GDPR Article 30(1)(g)(Controllers must maintain updated processing records)

Recital 82(Controllers should document changes in processing activities)