GDPR requirements in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

📋 Factual

intermediate

What is the main purpose of the GDPR?

Which of the following best describes the main goal of the General Data Protection Regulation (GDPR)?

A To manage trade agreements between EU member states

B To regulate financial transactions between EU countries

C To enforce copyright laws on digital content

D To protect personal data and privacy of individuals within the European Union

💡 Hint

Think about what GDPR stands for and who it protects.

The GDPR is designed to protect the personal data and privacy rights of individuals in the EU, ensuring organizations handle data responsibly.

🧠 Conceptual

intermediate

Which principle requires data to be collected only for specific purposes?

Under GDPR, which principle states that personal data must be collected for clear and legitimate reasons?

A Accountability

B Data minimization

C Purpose limitation

D Storage limitation

💡 Hint

Consider the principle that limits why data can be collected.

Purpose limitation means data should only be collected for specific, explicit, and legitimate purposes, not for anything else.

🔍 Analysis

advanced

What happens if a company fails to report a data breach within 72 hours?

According to GDPR, what is the consequence if an organization does not notify the relevant authority about a personal data breach within 72 hours?

A They may face heavy fines and penalties

B They will receive a warning but no fines

C The breach is automatically considered resolved

D They must delete all personal data immediately

💡 Hint

Think about GDPR's enforcement and penalties for non-compliance.

GDPR requires timely breach notification; failure to comply can result in significant fines to encourage accountability.

❓ Comparison

advanced

Which right allows individuals to request deletion of their personal data?

Under GDPR, which right gives people the ability to ask organizations to erase their personal data?

A Right to erasure (right to be forgotten)

B Right to data portability

C Right to access

D Right to object

💡 Hint

Consider the right that involves removing data completely.

The right to erasure, also called the right to be forgotten, allows individuals to have their personal data deleted under certain conditions.

❓ Reasoning

expert

How does GDPR affect companies outside the EU?

Which statement best explains how GDPR applies to companies located outside the European Union?

A GDPR applies only to companies physically located in the EU

B GDPR applies to any company processing personal data of EU residents, regardless of location

C GDPR applies only if the company has an office in the EU

D GDPR does not apply to companies outside the EU under any circumstances

💡 Hint

Think about who GDPR protects and when it applies.

GDPR protects EU residents' data and applies to any company processing their data, even if the company is outside the EU.