PDPF Exin Privacy and Data Protection Foundation Free Practice Exam Questions (2025 Updated)

Section: (none)

Explanation

These are the minimum information that a notification of personal data breach to the supervisory authority must contain:

3. The notification referred to in paragraph 1 shall at least:

a)Describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

b)Communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;

c)Describe the likely consequences of the personal data breach;

d)Describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

The right to compensation. Incorrect. It is unlikely that all data subjects will suffer harm that must be compensated in this scenario.

The right to object to profiling. Correct. All data subjects have a right to object to the processing of personal data for direct marketing, including profiling. This is clearly profiling. (Literature: A, Chapter 4)

The right to rectification. Incorrect. It is unlikely that the company has incorrect data on all data subjects, so the right to rectification does not apply.

€ 10.000.000 or 2% of the annual global turnover, whichever is higher. Correct. This is the maximum according to the GDPR for infringement of the personal data breach notification obligation. (Literature: A, Chapter 7; GDPR Article 33)

€ 20.000.000 or 4% of the annual global turnover, whichever is higher. Incorrect. This fine is given for non- compliance or non-conformity to the basic principles for processing, including conditions for consent.

Up to € 500.000 with a minimum of € 120.000. Incorrect. This is an outdated number based on the Dutch Penal code. GDPR rules specify higher fines.

Up to € 820.000 with a minimum of € 350.000. Incorrect. This is an outdated number based on the Dutch Penal code. GDPR rules specify higher fines.