PECB GDPR Exam With Confidence Using Practice Dumps

UnderArticle 30 of GDPR, controllers and processorsmust maintain a record of processing activities (ROPA). Whenever changes occurin the way personal data is processed(such as a transfer to cloud storage), theDPO must ensure these changes are recorded in the processing register.

Option B is correctbecause theDPO must ensure the data processing register is updated to reflect the new storage method.

Option A is incorrectbecausestorage changes do not require new consent unless the purpose of processing has changed.

Option C is incorrectbecause whileassessing security measures is important, it is not theprimary dutyrelated to the data processing register.

Option D is incorrectbecausenot all processing changes require notifying the supervisory authorityunless they introduce high riskswithout proper safeguards.

References:

GDPR Article 30(1)(g)(Controllers must maintain updated processing records)

Recital 82(Controllers should document changes in processing activities)

UnderArticle 7(1) of GDPR, controllers must be able todemonstrate that the data subject has given consent. TheDPO advises on ensuring these procedures are in placebutdoes not collect or approve consent directly.

Option B is correctbecausethe DPO must verify that consent records exist and meet GDPR standards.

Option A is incorrectbecauseinforming data subjects about withdrawal rights is the controller’s duty, not the DPO’s.

Option C is incorrectbecausethe DPO does not personally maintain consent logs.

Option D is incorrectbecauseDPOs do not approve legal bases for processing—this is the controller’s responsibility.

References:

GDPR Article 7(1)(Controller must demonstrate valid consent)

GDPR Article 39(1)(b)(DPO ensures compliance with data protection obligations)

UnderArticle 34(3)(a) of GDPR, if personal datais encrypted or otherwise protected, notification to data subjectsis not requiredunless the risk is high.

Option C is correctbecauseencryption renders the data unintelligible to unauthorized parties, reducing risk.

Option A is incorrectbecausenot all breaches require data subject notification—only those posing high risks.

Option B is incorrectbecausethe number of affected individuals does not determine notification requirements.

Option D is incorrectbecausenotification is based on risk assessment, not supervisory authority requests alone.

References:

GDPR Article 34(3)(a)(No notification required if encryption makes data inaccessible)

Recital 86(Notification is necessary only if data loss poses a significant risk)