Data Protection MCQ 60 Tests With Answers (2026)

Incorrect·D: The Controller determines the purposes and means of processing; the Processor simply processes the data on behalf of the Controller

GDPR Article 4 defines the Controller as the entity that determines the "why" and "how" of processing. The Processor acts only on the Controller's documented instructions. Controllers bear primary GDPR obligations; Processors have specific duties under Article 28 and may face direct liability under Article 82.

Incorrect·B: To systematically identify and mitigate the privacy risks associated with new projects or processing activities that are likely to result in high risk to individuals

GDPR Article 35 mandates DPIAs before undertaking processing that is likely to result in high risk — such as large-scale profiling, systematic monitoring of public areas, or processing special category data. The DPIA documents the assessment of necessity, proportionality, risks, and mitigating measures.

Incorrect·C: Embedding data protection and privacy principles into the architecture of IT systems and business practices from the very beginning, rather than bolting them on later

Privacy by Design (PbD) was developed by Ann Cavoukian and is now mandated by GDPR Article 25. Its seven foundational principles require privacy to be proactive not reactive, privacy as the default, privacy embedded into design, full functionality (not zero-sum), end-to-end security, visibility and transparency, and respect for user privacy.

Incorrect·B: Pseudonymization replaces direct identifiers with artificial identifiers, but the data can still be re-identified with an external key; Anonymization irreversibly destroys any ability to identify the subject

GDPR Recital 26 draws a clear line: pseudonymized data is still personal data (the key enabling re-identification must be kept separately and securely). Truly anonymized data falls outside the GDPR entirely. Tokenization and hashing are common pseudonymization techniques; differential privacy and data generalization are anonymization approaches.

Incorrect·D: To independently oversee data protection strategy, advise on compliance, and act as the liaison with supervisory authorities

GDPR Articles 37–39 establish the DPO role. A DPO must have expert knowledge of data protection law, operate independently without conflict of interest, advise on DPIAs, monitor compliance, and act as the contact point for data subjects and the supervisory authority. Certain organizations are legally mandated to appoint one.

Incorrect·B: The pseudonymization and encryption of personal data

GDPR Article 32(1) explicitly lists pseudonymization and encryption as appropriate technical measures. It also requires the ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems, and the ability to restore data after an incident.

Incorrect·C: A legal request made by an individual to an organization asking for a copy of all the personal data the organization holds about them

GDPR Article 15 grants data subjects the right of access. A DSAR entitles the individual to receive a copy of their personal data, information about how it is being processed, retention periods, recipients, and data subject rights. Organizations must respond within one calendar month (extendable by two months for complex requests).

Incorrect·B: Protected Health Information

PHI (Protected Health Information) is individually identifiable health information held or transmitted by a HIPAA-covered entity or business associate. The HIPAA Privacy Rule lists 18 identifiers that must be removed to de-identify health data. PHI includes past, present, or future physical or mental health, healthcare provision, or payment information.

Incorrect·A: A Data Processing Agreement (DPA)

GDPR Article 28(3) mandates a written Data Processing Agreement (DPA) between every controller and processor. The DPA must specify the subject matter, duration, nature and purpose of processing, type of personal data, categories of data subjects, and the controller's obligations and rights — including sub-processor authorization terms.

Incorrect·D: The legal justification required (e.g., consent, legitimate interest, contract) before an organization can legally process personal data

GDPR Article 6 lists six lawful bases: (1) Consent, (2) Contract, (3) Legal obligation, (4) Vital interests, (5) Public task, and (6) Legitimate interests. Controllers must identify and document their lawful basis before initiating processing. Without a lawful basis, processing is unlawful regardless of technical safeguards.

Incorrect·B: Processing data because the organization has a genuine, valid reason that is not overridden by the fundamental rights and freedoms of the data subject

GDPR Article 6(1)(f) — Legitimate Interests — requires a three-part test: (1) Is there a legitimate interest? (2) Is processing necessary to achieve it? (3) Is the interest overridden by the data subject's rights and freedoms? A Legitimate Interests Assessment (LIA) must be documented. It cannot override children's data or special category data without additional grounds.

Incorrect·D: A formal determination by the European Commission that a non-EU country offers a level of data protection equivalent to that provided within the EU

GDPR Article 45 enables data transfers to third countries only when the European Commission has issued an adequacy decision. Countries with adequacy include UK, Switzerland, Japan, Canada (partially), and Israel. Absent an adequacy decision, transfers require appropriate safeguards such as SCCs, BCRs, or specific derogations.

Incorrect·C: Ensuring that, out of the box, the strictest privacy settings automatically apply without any manual intervention from the user

Privacy by Default (GDPR Article 25(2)) requires that only personal data that is necessary for the specific purpose is processed by default. For example, optional profile fields should default to private, not public; data collection should be minimum by default, with users actively opting in to share more.

Incorrect·A: An organization cannot provide a copy of a user's data or delete it if they do not comprehensively know where all instances of that data are stored

DSAR responses require locating every instance of a data subject's information across all systems — CRMs, email archives, backups, third-party processors, and shadow IT. Organizations without a data map risk incomplete responses (regulatory violation), over-sharing (privacy violation), or failing to locate data at all.

Incorrect·B: To ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment to protect cardholder data

PCI-DSS is a contractual security standard developed by the Payment Card Industry Security Standards Council. It applies to all entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD). Non-compliance can result in fines, card brand penalties, and loss of payment processing privileges.

Incorrect·A: It dictates that digital data is subject to the laws and regulations of the specific country in which it is physically stored

Data sovereignty means data stored in a given country is governed by that country's legal framework — including government access requests, cross-border transfer restrictions, and localization laws. This creates significant complexity for multinational cloud deployments, as data in France is governed by French/EU law, data in Russia by Russian law, etc.

Incorrect·D: It allows users to opt-out of having their personal data sold to or shared with third parties for cross-context behavioral advertising

The CPRA (effective January 2023) expanded the CCPA opt-out to cover both "sale" and "sharing" — the latter capturing sharing for cross-context behavioral advertising (i.e., targeted ads) even when no money changes hands. The opt-out link must be clearly displayed on the homepage and act immediately upon submission.

Incorrect·A: They may face severe administrative fines of up to €10 million or 2% of global annual turnover

GDPR Article 83(4) specifies fines of up to €10 million or 2% of total worldwide annual turnover for breaching Article 33 (breach notification to supervisory authority within 72 hours) or Article 34 (notification to affected data subjects without undue delay when high risk). More serious violations carry fines up to €20M/4%.

Incorrect·B: The right of an individual to have inaccurate or incomplete personal data corrected by the data controller

GDPR Article 16 grants data subjects the right to rectification without undue delay. This includes both correcting factual inaccuracies and completing incomplete data. Controllers must also notify any recipients (processors, third parties) to whom the data was disclosed, unless this proves impossible or disproportionate.

Incorrect·D: Format-preserving encryption that allows databases to be queried without decrypting sensitive fields

PETs are technologies that minimize personal data use while maximizing data security. Format-preserving encryption (FPE) allows analytics and operations on encrypted data without exposing plaintext. Other PETs include differential privacy, homomorphic encryption, data clean rooms, zero-knowledge proofs, and secure multi-party computation.

Incorrect·A: It invalidated the EU-US Privacy Shield, causing major disruption to transatlantic data flows and placing heavy reliance on Standard Contractual Clauses (SCCs)

The CJEU's Data Protection Commissioner v Facebook Ireland (C-311/18) judgment in July 2020 annulled the EU-US Privacy Shield framework due to US surveillance laws (FISA 702, EO 12333) lacking equivalent protections. It also placed new obligations on controllers using SCCs to conduct Transfer Impact Assessments — later addressed (partially) by the EU-US Data Privacy Framework in 2023.

Incorrect·C: Internal rules adopted by multinational groups of companies to govern secure intra-organizational transfers of personal data across international borders

BCRs (GDPR Articles 46–47) are internal corporate codes of conduct approved by a Lead Supervisory Authority that allow multinational corporations to legitimize intra-group international data transfers without SCCs. They require demonstrating legally binding, enforceable rights for data subjects and accountability mechanisms across all group entities.

Incorrect·B: It ensures that any individual's data cannot be distinguished from at least k-1 other individuals within the same dataset, mitigating re-identification risks

k-anonymity (introduced by Latanya Sweeney) ensures each quasi-identifier combination in a dataset appears in at least k records. For example, 3-anonymity means at least 3 people share every combination of ZIP code, gender, and age group. Weaknesses include homogeneity attacks and background knowledge attacks, which led to l-diversity and t-closeness extensions.

Incorrect·A: By injecting a calculated amount of mathematical "noise" into the dataset, allowing accurate aggregate patterns to be analyzed while making it impossible to identify specific individuals

Differential privacy (DP), formalized by Cynthia Dwork, provides a mathematical guarantee: the probability of any specific output is essentially unchanged whether or not any individual's data is included. The privacy budget (epsilon, ε) controls the trade-off between utility and privacy. Apple, Google, and the US Census Bureau use DP in production systems.

Incorrect·C: To allow mathematical computations and analysis to be performed directly on ciphertext, generating an encrypted result without ever needing to expose the plaintext data

Fully Homomorphic Encryption (FHE) is the theoretical "holy grail" of privacy-preserving computation — enabling a cloud provider to compute on encrypted data and return an encrypted result, where only the data owner can decrypt. Partially (PHE) and leveled (LHE) homomorphic schemes are already in production use for specific operations like private information retrieval and private set intersection.

Incorrect·D: To provide a standardized mechanism for publishers, ad-tech vendors, and CMPs to communicate user consent and legitimate interest states across the digital advertising supply chain

The IAB Europe TCF provides a technical standard (via the TC String) encoding user consent and legitimate interest signals that are passed in OpenRTB bid requests to hundreds of ad-tech vendors. The Belgian DPA's 2022 ruling found TCF itself non-compliant with GDPR, highlighting the tension between real-time bidding architectures and consent requirements.

Incorrect·C: A mandatory assessment required after Schrems II to evaluate if the destination country's laws (like US surveillance laws) undermine the protections of Standard Contractual Clauses

Post-Schrems II, a TIA is required whenever SCCs are used for restricted transfers. It assesses the destination country's legal framework — particularly surveillance laws, government access rights, and judicial remedies — to determine whether SCCs can be effective or whether supplementary measures (encryption, pseudonymization) are needed to maintain equivalent EU protection.

Incorrect·B: A cryptographic method by which one party can prove to another that a specific statement is true (e.g., "I am over 18") without conveying any additional underlying information (like their exact birthdate)

ZKPs are a foundational cryptographic primitive for privacy-preserving authentication and compliance. Interactive ZKPs (Schnorr protocol) and non-interactive variants (zk-SNARKs, zk-STARKs — used in blockchain systems like Zcash) allow proving possession of a credential or satisfaction of a condition without disclosing the underlying data itself.

Incorrect·C: Secure, isolated environments where multiple parties can pool and analyze first-party data without exposing the underlying, raw Personally Identifiable Information to each other

Data clean rooms (e.g., Google Ads Data Hub, Amazon Marketing Cloud, LiveRamp) enable advertisers and publishers to perform audience analysis and campaign measurement on combined datasets using privacy-preserving techniques — aggregation thresholds, noise injection, and access controls — without either party ever seeing the other's raw user PII.

Incorrect·A: They must provide specific privacy information (a fair processing notice) to the data subject within a reasonable period, typically within one month

GDPR Article 14 requires controllers obtaining data indirectly (data brokers, third-party lists, web scraping) to proactively notify the data subject — within one month, or at first communication, or before disclosure to a third party (whichever comes first) — providing information on the source, purposes, legal basis, and data subject rights.

Incorrect·B: The risk that distinct, seemingly anonymized datasets can be combined and cross-referenced to successfully re-identify individuals

The Mosaic Effect demonstrates why "anonymization" is fragile: Latanya Sweeney showed that 87% of Americans can be uniquely re-identified by ZIP code, birth date, and sex alone. Netflix Prize de-anonymization, AOL search data re-identification, and NYT taxi data re-identification are landmark examples of the mosaic effect defeating claimed anonymization.

Incorrect·D: A user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, making it difficult for consumers to decline consent or opt-out

The CPRA (effective 2023) and CPPA regulations explicitly prohibit dark patterns in consent UIs. Examples include: requiring multiple clicks to opt-out vs. one click to opt-in, using confusing double negatives ("Don't uncheck to not opt out"), hiding opt-out buttons, using misleading colors (red for privacy-protective choice, green for data-sharing), and nagging re-consent flows.

Incorrect·C: Training a centralized machine learning model across multiple decentralized edge devices or servers holding local data samples, without exchanging the raw data itself

Federated Learning (introduced by Google in 2017 for Gboard) keeps training data on-device. Each device trains a local model update on its raw data, sends only the gradient updates (not raw data) to a central aggregator, which combines them into an improved global model. Combined with differential privacy and secure aggregation, it provides strong privacy guarantees for on-device ML.

Incorrect·B: Organizations must obtain informed, written consent before collecting or capturing any biometric identifiers or information

BIPA (740 ILCS 14) requires: (1) a publicly available biometric data retention/destruction policy, (2) written notice to subjects, (3) written consent before collection, and (4) a ban on profiting from biometrics. Critically, BIPA creates a private right of action with statutory damages of $1,000–$5,000 per violation — leading to multi-billion-dollar class actions against Meta, Google, and others.

Incorrect·D: The lifecycle of data — including its origin, what happens to it, and where it moves over time — vital for demonstrating compliance and executing data subject rights

Data lineage (or data provenance) tracks the full history of a data element: its source, transformations, storage locations, sharing relationships, and eventual deletion. In privacy operations, lineage enables accurate DSAR responses, breach impact assessment (which records were affected?), purpose limitation enforcement, and audit trail production for regulatory inspections.

Incorrect·C: As a browser-level technical signal communicating a user's choice to opt-out of the sale or sharing of their personal data universally across participating websites

GPC is a browser or extension-level HTTP header signal (Sec-GPC: 1) that communicates a user's universal opt-out preference. The California AG confirmed in 2022 that GPC is a valid opt-out mechanism under CCPA. Participating websites must honor it as equivalent to presenting a "Do Not Sell" request. Firefox, Brave, and DuckDuckGo natively support GPC.

Incorrect·B: A comprehensive, written document maintained by controllers and processors detailing the categories of data processed, purposes, recipients, and retention schedules

GDPR Article 30 mandates that controllers with ≥250 employees (or those processing high-risk data regularly) maintain a written RoPA. It must document: the controller's name/contact, purposes of processing, categories of data subjects and data, recipients, third-country transfers, retention periods, and technical/organizational security measures. It must be provided to supervisory authorities on request.

Incorrect·C: Tracking a user across the web by analyzing their unique browser attributes (fonts, screen resolution, OS), allowing profiling even if traditional cookies are blocked

Canvas fingerprinting, AudioContext fingerprinting, and WebGL fingerprinting exploit deterministic differences in how each device renders content to create a highly stable, cross-site identifier that persists across incognito mode, cookie deletion, and VPN usage. The CJEU (Case C-252/21, Meta Platforms) and ICO treat fingerprinting as personal data processing subject to GDPR and ePrivacy consent requirements.

Incorrect·A: Two or more controllers jointly determine the purposes and means of processing personal data, sharing the legal responsibilities and liabilities

GDPR Article 26 defines joint controllers as entities that together determine the purposes and means of processing. They must agree in a transparent arrangement (which may be public) on their respective responsibilities for fulfilling GDPR obligations — particularly data subject rights. The Facebook Fan Page case (C-210/16) established that Facebook and page administrators are joint controllers.

Incorrect·A: The idea that privacy is violated when data is used or shared in a way that breaks the specific norms, expectations, and context in which it was originally collected

Contextual Integrity, developed by philosopher Helen Nissenbaum, argues that privacy is not about secrecy per se, but about appropriate information flow. A medical record shared with a treating physician respects context; the same record shared with an insurer or employer violates it. This framework underpins privacy by design and purpose limitation, and informs how regulators assess secondary data use.