PC-DP Sample Questions & Answers
The accountability principle and DPIAs carry the biggest share, just ahead of breaches, enforcement and liability, with smaller topics spanning controller obligations, lawful bases, data subject rights, children's data, and how AI affects personal data.
Launch the full PC-DP simulator →Showing 6 of 12 free samples.
- Question 1Advanced
Principles of Data Protection and Applicable Terminology · Key terminology definitions
HealthScan Diagnostics is conducting a clinical trial. To protect patient privacy, the data engineering team strips all direct identifiers (names, NHS numbers) from the dataset and replaces them with a unique alphanumeric string (e.g., 'Patient-77X9'). The mapping table that links 'Patient-77X9' back to the individual's actual identity is kept on an isolated, highly secure server accessible only by the Chief Medical Officer.
Which of the following statements accurately categorizes this dataset under the UK GDPR?
flowchart LR A[Raw Patient Data] -->|Identifier Stripping| B[Alphanumeric Code] A -->|Mapping Table| C[Secure Server] B --> D[Research Dataset] C -.->|Re-identification possible| DShow answer & explanation
Correct answer: C
Under Article 4(5) of the UK GDPR, pseudonymisation is the processing of personal data in such a manner that it can no longer be attributed to a specific data subject without the use of additional information. Because the mapping table still exists within the organization (even if heavily restricted), the individuals can technically be re-identified. Therefore, pseudonymised data is still considered personal data and remains fully within the scope of the UK GDPR. True anonymization requires that re-identification be impossible.
- Question 2Intermediate
Principles of Data Protection and Applicable Terminology · UK GDPR data processing principles
A retail banking institution originally collected customer transaction data solely for the purpose of executing payments and preventing financial fraud. Two years later, the marketing department wants to extract this transaction data, aggregate it, and feed it into an external AI marketing tool to predict future consumer purchasing trends and send highly targeted third-party advertisements.
When evaluating this new processing activity against the Article 5(1)(b) 'Purpose Limitation' principle, which factor is the bank required to assess?
Show answer & explanation
Correct answer: C
The Purpose Limitation principle (Article 5(1)(b)) states that personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Before reusing data for a new purpose, the controller must conduct a 'compatibility test' (Article 6(4)), evaluating factors like the link between the original and new purposes, the context of collection, the nature of the data, and the consequences for the data subjects.
- Question 3IntermediateSelect 2
Lawful Bases for Processing Personal Data · Special category data conditions (Article 9)
A registered trade union in the UK has developed a mobile application for its members. The app actively collects data revealing the members' political opinions and trade union membership status to organize local rallies.
Under Article 9 of the UK GDPR and Schedule 1 of the DPA 2018, which TWO of the following represent valid conditions that the trade union could potentially rely upon to lawfully process this special category data? (Select TWO)
Show answer & explanation
Correct answers: B, C
Article 9(2)(a) allows the processing of special category data if the data subject has given explicit consent. Additionally, Article 9(2)(d) specifically permits processing carried out in the course of legitimate activities with appropriate safeguards by a foundation, association, or any other not-for-profit body with a political, philosophical, religious, or trade union aim, provided the processing relates solely to members or former members.
Article 9(2)(a) allows the processing of special category data if the data subject has given explicit consent. Additionally, Article 9(2)(d) specifically permits processing carried out in the course of legitimate activities with appropriate safeguards by a foundation, association, or any other not-for-profit body with a political, philosophical, religious, or trade union aim, provided the processing relates solely to members or former members.
- Question 4Advanced
Lawful Bases for Processing Personal Data · Article 6 lawful bases
A large logistics company wants to install advanced telematics and cabin-facing cameras in all its delivery trucks to monitor driver fatigue and harsh braking. The HR department suggests asking employees to sign a consent form authorizing this tracking. The Data Protection Officer (DPO) advises against using 'Consent' as the lawful basis and recommends 'Legitimate Interests' instead.
Why is the DPO's advice technically correct in this specific employment context?
Show answer & explanation
Correct answer: C
Under the UK GDPR, for consent to be valid, it must be freely given. The ICO and the EDPB have consistently stated that in an employer-employee relationship, there is an inherent imbalance of power. Employees may feel compelled to consent fearing negative consequences. Therefore, consent is rarely appropriate in employment contexts. Legitimate interests (Article 6(1)(f)) is generally the more appropriate basis, provided the employer conducts a Legitimate Interests Assessment (LIA) to ensure their interests are not overridden by the employees' rights and freedoms.
- Question 5Advanced
Accountability Principle · Data Protection Impact Assessments (DPIAs)
FinTrust Bank is developing a highly innovative, AI-driven credit scoring algorithm that will process the financial transaction histories of 5 million customers to automatically approve or reject mortgage applications without any human involvement. During the Data Protection Impact Assessment (DPIA), the project team identifies several high risks regarding algorithmic bias and transparency. Despite implementing multiple mitigation measures, the residual risk remains stubbornly high.
According to Article 36 of the UK GDPR, what is the mandatory next step for FinTrust Bank before they can deploy this system?
flowchart TD A[Conduct DPIA] --> B{Are risks identified?} B -->|Yes| C[Apply Mitigations] B -->|No| D[Proceed with processing] C --> E{Is residual risk still HIGH?} E -->|No| D E -->|Yes| F[???]Show answer & explanation
Correct answer: B
Article 36 of the UK GDPR stipulates that if a DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk (i.e., the residual risk remains high despite mitigations), the controller is legally required to consult the supervisory authority (the ICO in the UK) prior to processing. You cannot simply accept a high residual risk when processing personal data without regulatory consultation.
- Question 6Intermediate
Accountability Principle · Record of Processing Activity (RoPA)
Under Article 30 of the UK GDPR, controllers are required to maintain a Record of Processing Activities (RoPA) to demonstrate accountability. While many elements are mandatory, which of the following items is explicitly NOT a statutory requirement to be included in a controller's RoPA?
Show answer & explanation
Correct answer: C
Article 30 of the UK GDPR strictly defines the mandatory contents of a Record of Processing Activities (RoPA). It must include the name/details of the controller, purposes of processing, categories of data subjects/data, recipients, international transfers, retention schedules, and general security measures. It does NOT legally require the inclusion of staff training attendance logs, although keeping such logs elsewhere is a good practice for demonstrating general accountability under Article 5(2).
Ready for the real thing?
The full PC-DP simulator has every exam-style question, timed mode, and instant scoring.