Discuss Exin PDPF Exam Topic 5 Question 96

When is a Data Protection Impact Assessment (DPIA) under the General Data Protection Regulation (GDPR) mandatory?

AApplication of new technologies that may imply a high risk to the rights and freedoms of data subjects.

BThere is no security policy and information security risk analysis.

CIn all types of personal data processing.

Suggested Answer: A

Whenever a new technology is applied, a DPIA must be performed. In addition, a DPIA must be performed before starting the processing of personal data. This is important to check for risks to data subjects since data collection.

In its Article 35 the GDPR legislates on the Impact assessment on data protection.

1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.

Get Premium PDPF Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Yuette 3 months ago

B seems important too, but A is the main reason for DPIA.

Mira 4 months ago

Definitely A! High risk means we need a DPIA.

Timothy 4 months ago

I think A is correct. New tech can really impact data rights.

Ettie 4 months ago

Definitely option A, but I wish they made it clearer!

Benton 4 months ago

Not sure about that, seems like a stretch for every case.

Cherry 4 months ago

Wait, isn't it also needed for all personal data processing?

Stephen 6 months ago

Totally agree, option A is spot on!

Alesia 6 months ago

A DPIA is mandatory when new tech poses high risks to data subjects.

Adaline 7 months ago

I thought a DPIA was only required if there was a significant risk, but I'm confused about the other options. Could B be relevant if there's no security policy?

Alica 7 months ago

I practiced a question similar to this, and I believe that option A aligns with the GDPR requirements for a DPIA.

Sherell 7 months ago

I'm not entirely sure, but I think a DPIA isn't needed for all types of personal data processing. It seems more specific than that.

Alpha 7 months ago

I remember that a DPIA is mandatory when new technologies are involved, especially if they pose a high risk to data subjects. So, I think A is correct.

Exin PDPF Exam - Topic 5 Question 96 Discussion