VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

BCS Practitioner Certificate in Data Protection Free Sample Questions

Description

Covers data protection legislation and terminology, lawful bases for processing, accountability and DPIAs, controller and processor obligations, international transfers, data rights, and breaches.

12 free sample questions135 in the full practice test

Try simulator

PC-DP Sample Questions

  1. Question 1

    Advanced

    Context of Data Protection Legislation · Concepts of data protection and privacy

    A local municipal council, the Borough of Oakhaven, installs covert surveillance cameras in a public park to identify individuals engaging in persistent fly-tipping (illegal waste dumping). A local civil liberties group challenges this action, citing a breach of the individuals' right to respect for private and family life. Under the context of the Human Rights Act 1998 and the European Convention on Human Rights (ECHR), which of the following statements is technically accurate regarding this scenario?

    Answer and explanation

    Correct answer: C

    Article 8 of the European Convention on Human Rights (ECHR) provides the right to respect for private and family life, home, and correspondence. However, it is a 'qualified' right, not an absolute one. This means a public authority can sometimes interfere with this right if it is in accordance with the law, pursues a legitimate aim (such as the prevention of crime), and is necessary and proportionate. Covert surveillance must be heavily justified but is not inherently forbidden in all circumstances.

  2. Question 2

    Beginner

    Context of Data Protection Legislation · Territorial scope and jurisdiction of GDPR

    True or False: A cloud software provider headquartered exclusively in Tokyo, Japan, with no offices or representatives in the United Kingdom, offers a specialized accounting application. The application allows users to select 'Great British Pounds (GBP)' as a currency, provides a dedicated UK customer service phone line, and actively runs targeted social media campaigns aimed at London-based financial firms. Under Article 3 of the UK GDPR, the Tokyo-based provider is completely exempt from UK data protection legislation because they have no physical establishment in the UK.

    Answer and explanation

    Correct answer: B

    Article 3 of the UK GDPR contains extra-territorial provisions. Even without a physical presence in the UK, a controller or processor based outside the UK is subject to the UK GDPR if they process personal data of individuals in the UK in relation to the offering of goods or services to them, or the monitoring of their behavior. The use of GBP, targeted campaigns, and dedicated UK lines clearly indicate an intention to offer services to individuals in the UK.

  3. Question 3

    Intermediate

    Context of Data Protection Legislation · History of data protection in the UK

    Following the UK's departure from the European Union, the legislative framework for data protection in the UK underwent significant structural changes. Which of the following best describes the core mechanism that established the 'UK GDPR'?

    Answer and explanation

    Correct answer: A

    To ensure legal continuity post-Brexit, the UK retained the EU GDPR in domestic law via the European Union (Withdrawal) Act 2018. It was then modified by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 to make it function effectively in a UK-only context, resulting in what is now known as the UK GDPR.

  4. Question 4

    Advanced

    Principles of Data Protection and Applicable Terminology · Key terminology definitions

    HealthScan Diagnostics is conducting a clinical trial. To protect patient privacy, the data engineering team strips all direct identifiers (names, NHS numbers) from the dataset and replaces them with a unique alphanumeric string (e.g., 'Patient-77X9'). The mapping table that links 'Patient-77X9' back to the individual's actual identity is kept on an isolated, highly secure server accessible only by the Chief Medical Officer.

    Which of the following statements accurately categorizes this dataset under the UK GDPR?

    flowchart LR A[Raw Patient Data] -->|Identifier Stripping| B[Alphanumeric Code] A -->|Mapping Table| C[Secure Server] B --> D[Research Dataset] C -.->|Re-identification possible| D
    Answer and explanation

    Correct answer: C

    Under Article 4(5) of the UK GDPR, pseudonymisation is the processing of personal data in such a manner that it can no longer be attributed to a specific data subject without the use of additional information. Because the mapping table still exists within the organization (even if heavily restricted), the individuals can technically be re-identified. Therefore, pseudonymised data is still considered personal data and remains fully within the scope of the UK GDPR. True anonymization requires that re-identification be impossible.

  5. Question 5

    Intermediate

    Principles of Data Protection and Applicable Terminology · UK GDPR data processing principles

    A retail banking institution originally collected customer transaction data solely for the purpose of executing payments and preventing financial fraud. Two years later, the marketing department wants to extract this transaction data, aggregate it, and feed it into an external AI marketing tool to predict future consumer purchasing trends and send highly targeted third-party advertisements.

    When evaluating this new processing activity against the Article 5(1)(b) 'Purpose Limitation' principle, which factor is the bank required to assess?

    Answer and explanation

    Correct answer: C

    The Purpose Limitation principle (Article 5(1)(b)) states that personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Before reusing data for a new purpose, the controller must conduct a 'compatibility test' (Article 6(4)), evaluating factors like the link between the original and new purposes, the context of collection, the nature of the data, and the consequences for the data subjects.

  6. Question 6

    IntermediateMultiple answers

    Lawful Bases for Processing Personal Data · Special category data conditions (Article 9)

    A registered trade union in the UK has developed a mobile application for its members. The app actively collects data revealing the members' political opinions and trade union membership status to organize local rallies.

    Under Article 9 of the UK GDPR and Schedule 1 of the DPA 2018, which TWO of the following represent valid conditions that the trade union could potentially rely upon to lawfully process this special category data? (Select TWO)

    Answer and explanation

    Correct answers: B, C

    Article 9(2)(a) allows the processing of special category data if the data subject has given explicit consent. Additionally, Article 9(2)(d) specifically permits processing carried out in the course of legitimate activities with appropriate safeguards by a foundation, association, or any other not-for-profit body with a political, philosophical, religious, or trade union aim, provided the processing relates solely to members or former members.

Register free for 6 more questions

Or unlock all 135 PC-DP questions with explanations, timed mode and flashcards.

Related practice tests

All BCS practice exams