GDPR requirements in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the sentence to identify a key GDPR principle.

Cybersecurity

GDPR requires that personal data must be processed [1] and fairly.

Drag options to blanks, or click blank then click option'

Aillegally

Blawfully

Crandomly

Dsecretly

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing 'illegally' or 'secretly' which are against GDPR rules.

GDPR mandates that personal data must be processed lawfully and fairly to protect individuals' rights.

2fill in blank

medium

Complete the sentence about data subject rights under GDPR.

Cybersecurity

Under GDPR, individuals have the right to [1] their personal data held by organizations.

Drag options to blanks, or click blank then click option'

Adelete

Bignore

Chide

Dsell

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing deletion with ignoring or selling data.

GDPR gives individuals the right to request deletion of their personal data, known as the 'right to be forgotten'.

3fill in blank

hard

Fix the error in the GDPR data breach notification rule.

Cybersecurity

Organizations must notify the supervisory authority within [1] hours of becoming aware of a personal data breach.

Drag options to blanks, or click blank then click option'

A30

B7

C72

D14

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing 7 or 14 days which are too long under GDPR.

GDPR requires notification within 72 hours (3 days) of discovering a personal data breach.

4fill in blank

hard

Fill both blanks to complete the GDPR data minimization principle.

Cybersecurity

Personal data collected must be [1] and [2] to what is necessary for the purpose.

Drag options to blanks, or click blank then click option'

Aadequate

Bexcessive

Crelevant

Dirrelevant

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing 'excessive' or 'irrelevant' which contradict GDPR principles.

GDPR requires data to be adequate and relevant, meaning only what is necessary should be collected.

5fill in blank

hard

Fill all three blanks to complete the GDPR accountability requirements.

Cybersecurity

Organizations must implement [1], maintain [2], and demonstrate [3] with GDPR rules.

Drag options to blanks, or click blank then click option'

Atechnical measures

Brecords of processing activities

Ccompliance

Dmarketing campaigns

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing unrelated options like 'marketing campaigns'.

GDPR accountability means organizations must have technical measures, keep records, and show compliance with the law.

Practice

1. What is the main purpose of the GDPR?

easy

A. To protect personal data and privacy of individuals

B. To regulate financial transactions in the EU

C. To control internet speeds across countries

D. To manage copyright laws for digital content

Solution

1. Step 1: Understand GDPR's focus

   GDPR stands for General Data Protection Regulation, which is designed to protect personal data and privacy.

2. Step 2: Eliminate unrelated options

   Options about financial transactions, internet speeds, and copyright laws are unrelated to GDPR's main goal.

3. Final Answer:

   To protect personal data and privacy of individuals -> Option A

4. Quick Check:

   GDPR = Protect personal data [OK]

Hint: GDPR always relates to personal data protection [OK]

Common Mistakes:

• Confusing GDPR with financial or internet regulations
• Thinking GDPR controls internet speed
• Mixing GDPR with copyright laws

2. Which of the following is a GDPR requirement for collecting personal data?

easy

A. Collect data without informing the user

B. Share data freely with third parties

C. Store data indefinitely without limits

D. Obtain clear and explicit consent from the user

Solution

1. Step 1: Identify GDPR's consent rule

   GDPR requires that organizations get clear and explicit consent before collecting personal data.

2. Step 2: Check other options for GDPR compliance

   Collecting data without informing, storing indefinitely, or sharing freely violate GDPR rules.

3. Final Answer:

   Obtain clear and explicit consent from the user -> Option D

4. Quick Check:

   Consent needed before data collection [OK]

Hint: Consent is mandatory before collecting personal data [OK]

Common Mistakes:

• Assuming data can be collected silently
• Believing data can be stored forever
• Thinking data can be shared without restrictions

3. Consider this code snippet representing a data request under GDPR:

request = {"user_id": 123, "consent": True, "data": "email"}
if request["consent"]:
    print("Data can be processed")
else:
    print("Consent required")

What will be the output?

medium

A. Consent required

B. Data can be processed

C. Error: KeyError

D. No output

Solution

1. Step 1: Check the consent value in the request

   The key "consent" has the value True, meaning consent is given.

2. Step 2: Follow the if condition logic

   Since consent is True, the code prints "Data can be processed".

3. Final Answer:

   Data can be processed -> Option B

4. Quick Check:

   Consent True means process data [OK]

Hint: True consent prints 'Data can be processed' [OK]

Common Mistakes:

• Assuming consent is False by default
• Expecting a KeyError due to missing keys
• Thinking no output occurs

4. A company stores personal data without a clear retention policy. Which GDPR principle is violated?

medium

A. Lawfulness of processing

B. Data minimization

C. Storage limitation

D. Data portability

Solution

1. Step 1: Understand storage limitation principle

   GDPR requires personal data to be kept only as long as necessary, which is storage limitation.

2. Step 2: Match the violation to the principle

   Storing data without a retention policy means no limit on storage time, violating storage limitation.

3. Final Answer:

   Storage limitation -> Option C

4. Quick Check:

   Unlimited storage breaks storage limitation [OK]

Hint: No retention policy breaks storage limitation rule [OK]

Common Mistakes:

• Confusing data minimization with storage limits
• Thinking lawfulness covers storage duration
• Mixing data portability with storage rules

5. A company wants to use customer data for marketing but only has implied consent from website visits. According to GDPR, what should the company do?

hard

A. Obtain explicit consent before using data for marketing

B. Use the data freely since the customer visited the site

C. Assume consent if the customer did not opt out

D. Share data with partners without informing customers

Solution

1. Step 1: Identify consent type needed for marketing

   GDPR requires explicit consent for using personal data in marketing, not implied or assumed consent.

2. Step 2: Determine correct action

   The company must get clear, explicit consent before using data for marketing purposes.

3. Final Answer:

   Obtain explicit consent before using data for marketing -> Option A

4. Quick Check:

   Marketing needs explicit consent [OK]

Hint: Marketing always requires explicit consent under GDPR [OK]

Common Mistakes:

• Assuming visiting a site equals consent
• Thinking opt-out is enough for consent
• Ignoring the need to inform customers