VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

BCS Foundation Certificate in Data Protection Free Sample Questions

Description

Covers UK GDPR history and terminology, lawful bases for processing personal data, accountability and DPIAs, controller and processor obligations, international transfers, and data subject rights.

12 free sample questions135 in the full practice test

Try simulator

FC-DP Sample Questions

  1. Question 1

    Beginner

    An Introduction to the History of Data Protection in the UK · Personal data rights awareness in EU and UK

    A UK-based healthcare research organization is evaluating its compliance framework in light of the Data (Use and Access) Act 2025 (DUA Act). They want to understand how this new legislation interacts with the existing UK GDPR and DPA 2018. Which of the following statements most accurately describes the legal mechanism by which the DUA Act 2025 alters the UK's data protection landscape?

    Answer and explanation

    Correct answer: D

    The Data (Use and Access) Act 2025 does not repeal the UK GDPR or the DPA 2018. Instead, it amends these existing pieces of legislation (as well as PECR) to reform specific areas of data protection, such as subject access request timelines and legitimate interests, while maintaining the core framework.

  2. Question 2

    Intermediate

    An Introduction to the History of Data Protection in the UK · Territorial scope and jurisdiction of UK GDPR

    True or False: Under Article 3 of the UK GDPR, a software company headquartered exclusively in Singapore that actively targets and sells its project management application in GBP to consumers residing in the UK is subject to the UK GDPR, despite having no physical establishment or servers within the UK.

    Answer and explanation

    Correct answer: A

    Under Article 3(2) of the UK GDPR, the regulation applies extraterritorially to controllers and processors not established in the UK if their processing activities are related to offering goods or services to data subjects who are in the UK. Targeting UK consumers and accepting GBP clearly indicates an intention to offer services to individuals in the UK.

  3. Question 3

    AdvancedMultiple answers

    An Introduction to the History of Data Protection in the UK · Personal data rights awareness in EU and UK

    Select TWO statements that correctly reflect the UK's data protection framework following its exit from the European Union. (Select TWO)

    Answer and explanation

    Correct answers: A, B

    The UK GDPR was created by retaining the EU GDPR in domestic law under the European Union (Withdrawal) Act 2018, as amended by subsequent data protection regulations.

    The DPA 2018 sits alongside the UK GDPR. It fills in the gaps left to member states/domestic law, such as establishing the ICO's powers, defining exemptions, and outlining conditions for processing special category and criminal offence data.

  4. Question 4

    Beginner

    Principles of Data Protection and Applicable Terminology · Key terminology definitions

    An e-commerce enterprise replaces direct customer identifiers (like names and emails) in its analytics database with randomly generated reference numbers. The mapping table linking these numbers back to the original identities is stored securely on a separate, heavily encrypted server with strict access controls. How does the UK GDPR classify the data in the analytics database?

    Answer and explanation

    Correct answer: B

    Pseudonymisation is a security measure where identifiers are replaced with pseudonyms. Because the mapping key still exists (even if kept separately and securely), the data can be re-identified. Therefore, under Article 4 and Recital 26, pseudonymised data remains personal data and is fully subject to the UK GDPR.

  5. Question 5

    Intermediate

    Principles of Data Protection and Applicable Terminology · Key terminology definitions

    "HealthTech Solutions" provides a cloud-based patient management system to "City General Hospital". The Hospital decides what patient data is collected, sets the retention periods, and uses the system to manage daily appointments. HealthTech Solutions decides which cloud infrastructure to use (Microsoft Azure), handles routine software maintenance, and applies security patches without altering the data's purpose. Under the UK GDPR, what are the respective roles of these entities?

    Answer and explanation

    Correct answer: D

    The Controller (City General Hospital) determines the "purposes and essential means" of processing (why the data is collected and what it is used for). The Processor (HealthTech Solutions) processes data on behalf of the controller and can decide on "non-essential means" like the specific hardware or software architecture. Microsoft Azure, engaged by the processor, acts as a sub-processor.

    graph TD A[City General Hospital] -->|Determines Purpose & Essential Means| B(Controller) C[HealthTech Solutions] -->|Processes on behalf of Controller| D(Processor) E[Microsoft Azure] -->|Engaged by Processor| F(Sub-processor) B -. Written Contract Art 28 .-> D D -. Prior Authorization .-> F

  6. Question 6

    Beginner

    Principles of Data Protection and Applicable Terminology · Key terminology definitions

    Which of the following data points collected by a fitness tracking mobile application is explicitly classified as "special category data" under Article 9 of the UK GDPR?

    Answer and explanation

    Correct answer: B

    Under Article 9, data concerning health is classified as special category data. Heart rate and blood pressure readings are clear indicators of a person's physical health status. General tracking like step counts, without revealing specific health conditions, is generally not considered special category unless combined with other data to infer health status.

Register free for 6 more questions

Or unlock all 135 FC-DP questions with explanations, timed mode and flashcards.

Related practice tests

All BCS practice exams