GDPR Exam Dumps : PECB Certified Data Protection Officer

UnderArticle 11(1) of GDPR, controllersare not required to process additional datafor the sole purpose of identifying data subjectsif such identification is not needed for processing.

Option C is correctbecausePinky does not store identifiable purchase data, so it is not required to create additional records.

Option A and B are incorrectbecauseGDPR does not obligate controllers to process additional data if identification is unnecessary.

Option D is incorrectbecausePinky cannot require additional information when it does not have a basis to process identity-linked data.

References:

GDPR Article 11(1)(Controllers are not required to process extra data for identification)

Recital 57(Data controllers should avoid collecting unnecessary identity data)

UnderArticle 2 of GDPR, the regulation applieswhenever personal data is processed by automated means, includingCCTV footage that captures identifiable individuals.

Option C is correctbecauseGDPR applies when surveillance cameras capture public or third-party areas beyond the shop owner’s premises.

Option A is incorrectbecausecommunity privacy requirements do not override GDPR.

Option B is incorrectbecauseGDPR applies even if the risk is low, as long aspersonal data (images of identifiable individuals) is processed.

Option D is incorrectbecauseGDPR applies to security cameras unless used solely for personal or household purposes(Recital 18).

References:

GDPR Article 2(1)(Material scope includes video surveillance)

Recital 18(Household exemption does not apply to public monitoring)

UnderArticle 7(1) of GDPR, controllers must be able todemonstrate that the data subject has given consent. TheDPO advises on ensuring these procedures are in placebutdoes not collect or approve consent directly.

Option B is correctbecausethe DPO must verify that consent records exist and meet GDPR standards.

Option A is incorrectbecauseinforming data subjects about withdrawal rights is the controller’s duty, not the DPO’s.

Option C is incorrectbecausethe DPO does not personally maintain consent logs.

Option D is incorrectbecauseDPOs do not approve legal bases for processing—this is the controller’s responsibility.

References:

GDPR Article 7(1)(Controller must demonstrate valid consent)

GDPR Article 39(1)(b)(DPO ensures compliance with data protection obligations)