GDPR Exam Dumps : PECB Certified Data Protection Officer

UnderArticle 34(3)(a) of GDPR, if personal datais encrypted or otherwise protected, notification to data subjectsis not requiredunless the risk is high.

Option C is correctbecauseencryption renders the data unintelligible to unauthorized parties, reducing risk.

Option A is incorrectbecausenot all breaches require data subject notification—only those posing high risks.

Option B is incorrectbecausethe number of affected individuals does not determine notification requirements.

Option D is incorrectbecausenotification is based on risk assessment, not supervisory authority requests alone.

References:

GDPR Article 34(3)(a)(No notification required if encryption makes data inaccessible)

Recital 86(Notification is necessary only if data loss poses a significant risk)

UnderArticle 82(2) of GDPR,processors can be held liablefor data breachesif they act outside or against the controller’s instructions. Processors mustcomply with the controller’s directivesor be held accountable.

Option B is correctbecauseprocessors are liable if they fail to follow the controller’s instructions.

Option A is incorrectbecauseprocessors do not take instructions directly from data subjects.

Option C is incorrectbecauseDPOs do not issue legally binding instructions to processors.

Option D is incorrectbecauseprocessors share liability under GDPR.

References:

GDPR Article 82(2)(Processor liability for non-compliance)

Recital 146(Joint liability between controllers and processors)

UnderArticle 35(3)(b) of GDPR, aDPIA is required for large-scale processing of sensitive data, includingmedical research on vulnerable individuals.

Option A is correctbecausemedical data and research involving vulnerable individuals require a DPIA.

Option B is incorrectbecauseencryption does not eliminate the need for a DPIA if the processing poses high risks.

Option C is incorrectbecausea general risk assessment does not replace a DPIAunderArticle 35.

Option D is incorrectbecauseretention period is not a deciding factor for DPIA necessity.

References:

GDPR Article 35(3)(b)(DPIA for special category data)

Recital 91(Risks to fundamental rights require DPIAs)