Free Preparation Discussions
MENU
BCS PDP9 Exam Questions
- Topic 1: Define the following key items of terminology/ Identify the accountability and data governance obligation
- Topic 2: Identify how the use of cookies and digital technologies is governed by data protection law
- Topic 3: Explain the rules for processing criminal offence data/ Demonstrate the process of conducting a DPIA
- Topic 4: Explain how a data protection complaint should be handled/ Analyse the impact of AI on the principles and concepts of data protection
- Topic 5: Demonstrate how to adopt a ‘data protection by design and by default’ approach
- Topic 6: Identify the role of tribunal and judicial courts/ Analyse the benefits versus the risks of AI for individuals and organisations
- Topic 7: Demonstrate a detailed knowledge of the key rights granted to individuals/ Describe the act of processing under the authority of a controller or processor
- Topic 8: Explain how data protection legislation applies to children/ Recognise the data protection implications of the Employment Practices Code
- Topic 9: Explain when the obligations arise to report breaches of personal data/ Describe the restrictions and exemptions that may affect data subject rights
- Topic 10: Explain the role of the Information Commissioner’s Office (ICO)/ Express awareness of the following rights in addition to the above
Free BCS PDP9 Exam Actual Questions
Note: Premium Questions for PDP9 were last updated On Jul. 21, 2026 (see below)
Who is entitled to a private life by law in the UK?
The right to a private life is a fundamental human right that is protected by law in the UK. Article 8 of the European Convention on Human Rights (ECHR), which is incorporated into UK law by the Human Rights Act 1998, states that ''Everyone has the right to respect for his private and family life, his home and his correspondence''. This right applies to all individuals, regardless of their status, profession, or public exposure. The right to a private life covers aspects such as personal identity, personal relationships, physical and mental well-being, personal data, and correspondence. However, this right is not absolute and can be limited or interfered with by the state or other parties in certain circumstances, such as for the protection of national security, public safety, health, morals, or the rights and freedoms of others.Reference:
Article 8 of the ECHR1
Human Rights Act 19982
ICO Guide to Data Protection3
When were data protection rights first introduced into UK law'?
Data protection rights were first introduced into UK law by the Data Protection Act 1984, which was enacted to implement the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 1981. The Data Protection Act 1984 established a set of principles for the processing of personal data by data users, such as obtaining consent, ensuring accuracy, and limiting retention. It also created a system of registration for data users and a Data Protection Registrar (later renamed as the Information Commissioner) to oversee and enforce the law. The Data Protection Act 1984 was replaced by the Data Protection Act 1998, which transposed the EU Data Protection Directive 1995 into UK law and extended the scope of data protection to cover manual as well as automated processing of personal data. The Data Protection Act 1998 was further amended by the Data Protection Act 2018, which incorporated the EU General Data Protection Regulation (GDPR) and the Law Enforcement Directive into UK law and made provisions for specific processing situations, such as national security, immigration, and journalism.Reference:
Data Protection Act 19844
Council of Europe Convention 1085
Data Protection Act 19986
Data Protection Act 20187
Which of the following statements MOST accurately describes the potential impact of Al on the principle of transparency?
The principle of transparency requires that any processing of personal data is fair, lawful and transparent to the data subjects. This means that data subjects should be informed about the existence, nature, purpose and consequences of the processing, as well as their rights and choices regarding their data. Transparency is essential for ensuring accountability, trust and compliance in data processing. However, the use of AI can pose challenges to the principle of transparency, as AI can lead to invisible processing, with data subjects not being aware of its presence, or the logic, significance and implications of the processing. For example, AI can be used to profile, infer, predict or influence the behaviour, preferences, interests, emotions or personality of data subjects, without their knowledge or consent. AI can also be used to make automated decisions that affect data subjects, such as credit scoring, recruitment, health diagnosis or social benefits, without providing meaningful explanations or opportunities for human intervention.Therefore, it is important to ensure that data subjects are informed and empowered when AI is involved in the processing of their data, and that they can exercise their rights, such as the right to access, rectify, object, restrict, erase or port their data, or the right to challenge or contest automated decisions56.Reference:
Guidance on AI and data protection5
Explaining decisions made with AI6
Which of the below would be the BEST example of processing that could utilise the Public Interest Task lawful basis?
The public interest task lawful basis applies to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The relevant task or authority must have a clear basis in domestic law, such as a statutory power, a common law duty, or a function of the Crown, central or local government. The processing must also be necessary, meaning that there is no reasonable and less intrusive way to achieve the same purpose. The public interest task lawful basis is most relevant to public authorities, but it can also apply to any organisation that exercises official authority or carries out tasks in the public interest. In scenario C, a local authority processing the personal information of the person responsible for paying council tax is likely to rely on the public interest task lawful basis, as it is performing a task in the public interest that is laid down by law, namely the Local Government Finance Act 1992, and the processing is necessary for the collection and administration of council tax. In contrast, scenarios A, B and D are less likely to qualify for the public interest task lawful basis, as they do not involve a clear task or authority that is set out in law, or that serves the public interest. For example, a health authority processing the personal information of its staff in order to record all training undertaken may have a different lawful basis, such as legitimate interests or contractual necessity. A debt collection agency processing information relating to unpaid fines for misuse of community council car parking may not have any official authority or public interest justification for its processing. A tax authority dropping cookies on the devices of visitors to its website may not be able to demonstrate that the processing is necessary for its official functions, and may also need to comply with the Privacy and Electronic Communications Regulations (PECR) for the use of cookies.Reference:
UK GDPR, Article 6 (1) (e) and (3)8
ICO Guide to Data Protection, Public Task9
Local Government Finance Act 199210
Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?
A DPIA is not required to fulfil the requirement that all DPIAs are submitted to the ICO, because this is not a requirement under the GDPR. The GDPR only requires that the controller consults the ICO before carrying out processing that is likely to result in a high risk to individuals, if the controller cannot mitigate that risk. This means that not all DPIAs need to be submitted to the ICO, only those that identify a high residual risk that cannot be reduced. The other options are valid purposes of carrying out a DPIA, as they help the controller to comply with the GDPR, ensure data protection by design and by default, and identify and mitigate the main risks to individuals' rights and freedoms.Reference:
Article 35 and 36 of the GDPR3
ICO guidance on DPIAs5
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Charles Nelson
1 day agoNancy Robinson
8 days agoDonna Carter
1 month agoBetty Jackson
1 month agoSharon Rivera
2 months agoDeborah Bell
2 months agoNancy Jackson
3 months agoAndrew Lee
3 months agoMaria Taylor
3 months agoKimberly Anderson
3 months agoMargaret Nelson
3 months agoLisa Johnson
3 months agoLonny
4 months agoTimothy
4 months agoCarey
4 months agoAleshia
5 months agoIzetta
5 months agoAshlyn
5 months agoNguyet
6 months agoAliza
6 months agoDustin
6 months agoErasmo
6 months agoMollie
7 months agoFletcher
7 months agoKaron
7 months agoAleta
7 months agoShaquana
8 months agoBobbye
8 months agoLaquanda
8 months agoRolande
8 months agoMyra
9 months agoKenny
9 months agoKeith
9 months agoJunita
9 months agoCarma
10 months agoLeana
10 months agoMagda
10 months agoShizue
10 months agoKaty
11 months agoLeanna
11 months agoWillard
1 year agoGary
1 year agoCrista
1 year agoElke
1 year agoFrancisca
1 year agoMendy
2 years agoFabiola
2 years agoViola
2 years agoMatt
2 years agoIvette
2 years agoLemuel
2 years agoAngelica
2 years agoLauran
2 years agoDominque
2 years agoAileen
2 years agoVirgina
2 years agoViola
2 years agoDerick
2 years agoJules
2 years agoHubert
2 years agoEdison
2 years agoNa
2 years agoBrianne
2 years agoMonroe
2 years agoPatria
2 years agoArlyne
2 years agoMadonna
2 years agoTruman
2 years agoEmile
2 years agoMerlyn
2 years agoCarli
2 years ago