Exin PDPF Exam - Topic 3 Question 47 Discussion

Actual exam question for Exin's PDPF exam

Question #: 47
Topic #: 3

[All PDPF Questions]

According to the GDPR, when is a data protection impact assessment (DPIA) obligatory?

AWhen a project includes technologies or processes that use personal data

BWhen processing is likely to result in a high risk to the rights of data subjects

CWhen similar processing operations with comparable risks are repeated

Show Suggested Answer

Suggested Answer: B

When a project includes technologies or processes that use personal data. Incorrect. Only for technologies and processes that are likely to result in a high risk to the rights of data subjects is the DPIA mandatory.

When processing is likely to result in a high risk to the rights of data subjects. Correct. For processing operations which are likely to result in a high risk, a DPIA is obligatory to assess those risks and to design mitigation measures. (Literature: A, Chapter 6; GDPR Article 35)

When similar processing operations with comparable risks are repeated. Incorrect. This is a case in which a DPIA does not need to be repeated.

by Janey at Aug 30, 2023, 03:03 PM

Limited Time Offer

25%

Off

Get Premium PDPF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jade

3 months ago

C is also a factor, but B is the main trigger for a DPIA.

upvoted 0 times

...

Lindsey

3 months ago

Wait, so it’s not just about using personal data? That’s surprising!

upvoted 0 times

...

Danica

4 months ago

I thought it was just for new technologies, but I guess it's more than that.

upvoted 0 times

...

Tawny

4 months ago

Definitely B! Can't believe some people don't know this.

upvoted 0 times

...

Niesha

4 months ago

It's obligatory when there's a high risk to data subjects!

upvoted 0 times

...

Nu

4 months ago

I think option C might be relevant too, but it seems more about repeated operations rather than the initial requirement for a DPIA.

upvoted 0 times

...

Cassandra

4 months ago

I feel like I read something about DPIAs being necessary when using new technologies, but I can't recall if that's the main reason.

upvoted 0 times

...

Novella

5 months ago

I remember practicing a question about DPIAs, and it mentioned that they are required for high-risk processing activities. So, I think option B is correct.

upvoted 0 times

...

Garry

5 months ago

I think a DPIA is obligatory when processing is likely to result in a high risk to the rights of data subjects, but I'm not completely sure.

upvoted 0 times

...

Loise

5 months ago

I'm a bit confused by the wording of the options. I'll need to re-read the question and the GDPR guidelines to make sure I select the right answer.

upvoted 0 times

...

Teri

5 months ago

Okay, let me break this down step-by-step. I think the key is understanding when a DPIA is obligatory under the GDPR.

upvoted 0 times

...

Cherry

5 months ago

Hmm, I'm not sure about this one. I'll need to think it through carefully.

upvoted 0 times

...

Cristen

5 months ago

This question seems straightforward, I'm pretty confident I know the answer.

upvoted 0 times

...

Malinda

5 months ago

I've got this one! The GDPR says a DPIA is obligatory when the processing is likely to result in a high risk to the rights of data subjects. That's the key thing to remember here.

upvoted 0 times

...

Dorsey

5 months ago

Okay, let me think this through. I know the GDPR has certain triggers for when a DPIA is mandatory, like using new technologies or processes that involve personal data. I'll need to double-check the wording to make sure I get the right answer.

upvoted 0 times

...

Farrah

5 months ago

Hmm, I'm not totally sure about this one. I know the GDPR has some specific requirements around DPIAs, but I can't remember the exact details. I'll have to review that section again before answering.

upvoted 0 times

...

Jettie

5 months ago

I think this one is pretty straightforward. The GDPR clearly states that a DPIA is required when processing is likely to result in high risk to data subjects' rights.

upvoted 0 times

...

Jeanice

5 months ago

I remember learning about this in class. I believe the answer is B, when processing is likely to result in a high risk to the rights of data subjects.

upvoted 0 times

...

King

5 months ago

Hmm, I'm a bit unsure about the differences between the security predicate options here. I'll need to review my Tableau CRM security knowledge to make the best choice.

upvoted 0 times

...

Nikita

5 months ago

I feel like the statement about sufficient audit evidence is pretty standard, but I can't shake the feeling that maybe it's included sometimes.

upvoted 0 times

...

Junita

5 months ago

This seems like a tricky question. I'm not entirely sure, but I think using embedded forms or a pageflow might be the way to go. I'll have to think it through carefully.

upvoted 0 times

...

Florinda

5 months ago

Okay, process improvement - that's a concept we've covered in class. I think I know the right approach here, but I'll double-check my understanding just to be sure.

upvoted 0 times

...