Important Exin PDPF Exam Questions

CertPrep • Exin • PDPF Exam Questions

Select Certification Providers

Select Certification Exam

Get Full Version

Exin Privacy and Data Protection Foundation PDPF Exam

Attempt the EXIN Privacy & Data Protection Foundation practice test and solve real exam-like PDPF questions to prepare efficiently and increase your chances of success. Our Exin PDPF practice questions match the actual Privacy and Data Protection Foundation exam format, helping you enhance confidence and improve performance. With our PDPF practice exam software, you can analyze your performance, identify weak areas, and work on them effectively to boost your final EXIN Privacy & Data Protection Foundation exam score.

Vendor:	Exin
Exam Name:	Privacy and Data Protection Foundation
Registration Code:	PDPF
Related Certification:	Exin Privacy & Data Protection Foundation Certification
Exam Audience:

Total Questions

149

Last Updated

30-05-2026

Upgrade to Premium

GET FULL PDF

Question: 1

Personal data as defined in the GDPR can be divided into several types. One of these types is described: Data that directly or indirectly reveal someone's racial or ethnic background, political, philosophical, religious views, union affiliation and data related to health or sex life and sexual orientation. What type of personal data is this?

ADirect personal data

BIndirect personal data

CPseudonymized data

DSpecial category personal data

Answer: D

Explanation:

Direct personal data. Incorrect. Both direct and indirect data are described.

Indirect personal data. Incorrect. Both direct and indirect data are described.

Pseudonymized data. Incorrect. Pseudonymized data cannot directly reveal information.

Special category personal data. Correct. This is a definition of special category personal data. (Literature: A, Chapter 1; GDPR Article 4)

Question: 2

Which of the parts below can implement data protection by design (from conception)?

AThe data subject.

BThe Data Protection Officer (DPO).

CThe processor.

DThe supervisory authority.

Answer: C

Explanation:

It is the duty of the processor to guarantee security in the treatment of the data entrusted to it by the controller.

Question: 3

A shopkeeper wants to register how many visitors enter his shop every day. A system detects the MAC- address of each visitor's smartphone. It is impossible for the shopkeeper to identify the owner of the phone from this signal, but telephone providers can link the MAC-address to the owner of the phone. According to the GDPR, is the shopkeeper allowed to use this method?

AYes, because the shopkeeper cannot identify the owner of the telephone

BNo, because the telephone providers are the owners of the MAC-addresses.

CNo, because the telephone's MAC-address must be regarded as personal data.

DYes, because the visitor has automatically consented by connecting to the Wi-Fi

Answer: C

Explanation:

Yes, because the shopkeeper cannot identify the owner of the telephone. Incorrect. The issue is not whether the shopkeeper can identify the visitor, but that it is technically possible to do so.

Yes, because the visitor has automatically consented by connecting to the Wi-Fi. Incorrect. Consent must be an active, informed and free act of agreement to the processing. To see a MAC-address, the visitor does not need to be logged onto the Wi-Fi.

No, because the telephones MAC-address must be regarded as personal data. Correct. The phone's signal is a unique code that can be linked to the owner of the phone. The data must be regarded as personal data, because it is technically possible to identify the visitor. (Literature: A, Chapter 3; GDPR Article 26 and 30)

No, because the telephone providers are the owners of the MAC-addresses. Incorrect. The shopkeeper is not allowed to keep the data or process it because it must be regarded as personal data. The telephone provider is not the owner of the MAC-address, nor is the telephone provider protected by the GDPR.

Question: 4

A secretary at a pediatric cardiology clinic instead of sending the doctor the list of patients scheduled for the day, sends it to all those responsible registered for the children with scheduled appointments.

According to the GDPR, does the Supervisory Authority need to be notified? And those responsible for the data holders?

AThe Supervisory Authority must be notified, but there is no need to notify those responsible for the data subjects, as whoever had access to the data is also someone in the same situation.

BThe Supervisory Authority must be notified and also those responsible for the holders who had their data exposed.

CThere is no need to notify the Supervisory Authority, however those responsible for the holders who had
their data exposed must be notified.

DThere is no need to notify the Supervisory Authority or those responsible for the data subjects, as whoever had access to the data is also someone in the same situation.

Answer: B

Explanation:

This is an issue that addresses two very important points -- sensitive data and data from minors.

As these are, it is necessary to inform the Supervisory Authority and those responsible for the data subjects. Article 34 mentions:

1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.

Recital 38 says:

Children merit specific protection regarding their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.

Question: 5

Which of these should appear in a Data Protection Impact Assessment (DPIA) according to the General Data Protection Regulation (GDPR)?

AAn assessment of the need and proportionality of treatment operations in relation to the objectives.

BData Protection Officer (DPO) contact and responsibilities.

CAn inventory and the flow of personal data within the organization.

DA survey of other laws that must be taken into account in addition to the GDPR.

Answer: A

Explanation:

In its Article 35 the GDPR legislates on the Impact assessment on data protection.

7) The assessment shall contain at least:

a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;

b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes;

c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and

d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

SAVE TIME & QUICKLY PREPARE WITH REAL QUESTIONS

GET FULL ACCESS

Other Exin Certification Exams

CDFOM Exam

Certified Data Center Facilities Operations Manager

CDCP Exam

Certified Data Centre Professional Exam

CDCS Exam

EXIN EPI Certified Data Centre Specialist

CITM Exam

EXIN EPI Certified Information Technology Manager

VERISMF Exam

VeriSM Foundation

VERISME Exam

VeriSM Essentials