Data Protection Quiz

1. When we refer to data protection, what type of data are we referring to?

• A. Any data
• B. Only business data
• C. Sensitive personal and business data
• D. Personal data

2. What does the GDPR stand for?

• A. Government Data Processing Rules
• B. General Data Processing Regulation
• C. General Data Protection Regulation
• D. General Data Proficiency Rules
• E. Government Data Performance Regulations

3. When did the UK GDPR come into force?

• A. 2018
• B. 2020
• C. 2021
• D. 2023

4. Which of the following is not one of the GDPR data protection principles?

• A. Purpose limitation
• B. Data minimisation
• C. Credit card protection
• D. Storage limitation
• E. Accuracy

5. Which of these could be considered as personal data?

• A. IP address
• B. Name
• C. Email address
• D. Passport number
• E. All of the above

6. Which of the following is considered ‘special category’ data?

• A. Bank details
• B. Trade union membership
• C. Credit card details
• D. IP address
• E. Inside leg measurement

7. If an organisation suffers a breach of personal data which represents a likely risk to data subjects, how long does it have to report it to the regulator once it becomes aware of it?

• A. One week
• B. One month
• C. 72 hours
• D. When you know all the details
• E. 28 days

8. If an organisation suffers a personal data breach, when does it have to inform the data subjects?

• A. Every time someone’s data has been breached
• B. When it involves financial data
• C. When it might affect a customer order
• D. When it is likely to result in a high risk to the rights and freedoms of individuals
• E. When it is likely to cause the data subject financial damage

9. If someone asks an organisation for a copy of their data – known as a data subject access request – how long does it have to reply?

• A. 30 days
• B. 31 days
• C. 28 days
• D. One month
• E. When the ICO tells you to

10. Which statement best describes valid consent?

• A. Including assumed consent in terms and conditions
• B. Consent assumed unless the data subject objects
• C. Unticking a box to opt out
• D. Ticking a box to opt out
• E. A freely given, specific, informed and unambiguous indication of wishes by a clear affirmative action

11. When considering new processing, a new IT system or a new product which is likely to result in a high risk to the rights and freedoms of individuals, what assessment must you perform?

• A. Data privacy assessment
• B. Data security impact assessment
• C. Data protection impact assessment
• D. Personal data security assessment
• E. Security risk assessment

12. Which organisation is the regulator for data protection in the UK?

• A. Department for Business and Trade
• B. Department for Culture Media and Sport
• C. Data Standards Agency
• D. The Information Commissioner’s Office
• E. Office for Protection of Data