Exin PDPF Exam - Topic 1 Question 85 Discussion

Actual exam question for Exin's PDPF exam

Question #: 85
Topic #: 1

[All PDPF Questions]

When is a Data Protection Impact Assessment (DPIA) under the General Data Protection Regulation (GDPR) mandatory?

AApplication of new technologies that may imply a high risk to the rights and freedoms of data subjects.

BThere is no security policy and information security risk analysis.

CIn all types of personal data processing.

Show Suggested Answer

Suggested Answer: A

Whenever a new technology is applied, a DPIA must be performed. In addition, a DPIA must be performed before starting the processing of personal data. This is important to check for risks to data subjects since data collection.

In its Article 35 the GDPR legislates on the Impact assessment on data protection.

1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.

by Jeanice at Jun 15, 2025, 06:21 AM

Limited Time Offer

25%

Off

Get Premium PDPF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Bo

3 months ago

I thought DPIAs were only needed for specific cases, not all.

upvoted 0 times

...

Tiffiny

3 months ago

Totally agree, option A is spot on.

upvoted 0 times

...

Jamie

3 months ago

It's mandatory when new tech poses high risks to data subjects!

upvoted 0 times

...

Sanda

3 months ago

Wait, is it really mandatory for all processing? That seems off.

upvoted 0 times

...

Hubert

3 months ago

No security policy? That’s a big red flag!

upvoted 0 times

...

Maryanne

4 months ago

I feel like option A makes the most sense, but I’m a bit confused about the specifics of when a DPIA is actually required.

upvoted 0 times

...

Georgene

4 months ago

I practiced a question similar to this, and I think the focus was on assessing risks to rights and freedoms.

upvoted 0 times

...

Luke

4 months ago

I’m not entirely sure, but I think it’s not required for all types of personal data processing.

upvoted 0 times

...

Eric

4 months ago

I remember that a DPIA is mandatory when new technologies are involved, especially if they pose a high risk to data subjects.

upvoted 0 times

...

Annabelle

4 months ago

This is a good question to test our understanding of the GDPR. I think the key is to focus on the specific conditions outlined in the options that trigger the need for a mandatory DPIA. Option A seems to capture that best.

upvoted 0 times

...

Camellia

5 months ago

I'm a bit confused by this question. I know the GDPR has requirements around DPIAs, but I'm not sure of the specifics. I'll have to review my notes to see if I can figure out the right answer.

upvoted 0 times

...

Sunshine

5 months ago

Okay, I've got this. The GDPR requires a DPIA when new technologies are being used that could pose a high risk to data subjects. I'm confident that option A is the right answer here.

upvoted 0 times

...

Isabella

5 months ago

Hmm, this seems like a tricky one. I'm not totally sure about the GDPR requirements for when a DPIA is mandatory. I'll have to think this through carefully.

upvoted 0 times

...

Afton

5 months ago

I think this question is asking about the specific circumstances when a DPIA is required under the GDPR. I'll need to carefully review the options to determine the correct answer.

upvoted 0 times

...

Chanel

8 months ago

C is way too broad. DPIA isn't mandatory for every single personal data processing activity, that would be overkill.

upvoted 0 times

...

Dacia

8 months ago

Haha, B is definitely not it. No security policy? That's a recipe for disaster, not a DPIA requirement!

upvoted 0 times

...

Layla

8 months ago

I agree, A is the right answer. GDPR is all about protecting people's data, so a thorough impact assessment is necessary for high-risk processing.

upvoted 0 times

Helaine

7 months ago

Yes, I agree. It's important to assess the impact on data subjects when using new technologies.

upvoted 0 times

...

Lashawnda

7 months ago

I agree, A is the right answer. GDPR is all about protecting people's data, so a thorough impact assessment is necessary for high-risk processing.

upvoted 0 times

...

Jackie

7 months ago

A) Application of new technologies that may imply a high risk to the rights and freedoms of data subjects.

upvoted 0 times

...

Mitzie

8 months ago

A) Application of new technologies that may imply a high risk to the rights and freedoms of data subjects.

upvoted 0 times

...

Iesha

8 months ago

I believe a DPIA is not required for all types of personal data processing, only when there is a high risk involved.

upvoted 0 times

...

Tanja

8 months ago

I agree with Maile. Conducting a DPIA in such cases helps ensure data protection compliance.

upvoted 0 times

...

Maile

8 months ago

I think a DPIA is mandatory when applying new technologies that may pose a high risk to data subjects.

upvoted 0 times

...

Lynda

9 months ago

A seems like the correct answer. DPIA is required when new technologies pose high risks to individuals' rights and freedoms.

upvoted 0 times

Geoffrey

7 months ago

Not necessarily, DPIA is specifically for high-risk situations like new technologies.

upvoted 0 times

...

Moon

7 months ago

C) In all types of personal data processing.

upvoted 0 times

...

Tequila

8 months ago

Yes, that's correct. DPIA is necessary when there are high risks involved.

upvoted 0 times

...

Barney

8 months ago

A) Application of new technologies that may imply a high risk to the rights and freedoms of data subjects.

upvoted 0 times

...