support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. PECB
  4. GDPR

PECB GDPR Exam Prep
PECB Certified Data Protection Officer (Page 6 )

Updated On: 7-Oct-2026
Page 3 of 17
PDF with 80 Questions

Scenario: 2

Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number).
When the user clicks the email address box, a pop-up message appears as follows: "Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: "Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app.
When customers want to make a purchase, they are also required to provide their bank account details.
When the user finally creates the account, the following message appears: "Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following Questio n:

Questio n:

When completing the sign-up form, the user gets a notification about the purpose for which Soyled collects their email address. Is Soyled required by the GDPR to do so?

  1. Yes, users must be informed of the purpose of collecting their personal data.
  2. No, Soyled should provide this information only when requested by users.
  3. No, Soyled only needs to inform users about how their data is collected, stored, or processed.
  4. Yes, but only if the email is used for communication purposes beyond account creation.

Answer(s): A

Explanation:

Under Article 13 of GDPR, controllers must inform data subjects at the time of data collection about the purpose of processing their personal data. This ensures transparency and accountability.

Soyled provides a pop-up message explaining why the email is collected, which aligns with GDPR's transparency principles. Option A is correct. Option B is incorrect because GDPR requires notification at collection, not upon request. Option C is incorrect as GDPR mandates disclosure of purpose, not just storage and processing methods. Option D is misleading because the purpose must be disclosed regardless of communication intent.


Reference:

GDPR Article 13(1)(c) (Obligation to inform data subjects about processing purposes)

Recital 60 (Transparency and accountability in data collection)



Scenario: 2

Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings),

despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number).
When the user clicks the email address box, a pop-up message appears as follows: "Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: "Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app.
When customers want to make a purchase, they are also required to provide their bank account details.
When the user finally creates the account, the following message appears: "Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following Questio n:

Questio n:

The GDPR indicates that the processing of personal data should be based on a legal contract with the data subject. Based on scenario 6, has Soyled fulfilled this requirement?

  1. Yes, data subjects are informed about the purpose of collecting the email address and phone number before the data is collected.
  2. Yes, once the account is created, Soyled informs its customers that their personal data will be shared with the network.
  3. No, data subjects are informed that the personal data will be shared with Soyled's network only after the personal data is collected.
  4. No, because Soyled did not obtain explicit consent for data processing.

Answer(s): C

Explanation:

Under Article 6(1) of GDPR, processing personal data must have a lawful basis, such as consent,

contract, legal obligation, or legitimate interest. Additionally, under Article 13, controllers must inform users before collecting their data.

Soyled failed to disclose that personal data would be shared with the network before collection, which violates GDPR transparency requirements. Option C is correct. Option A is incorrect because informing about email collection does not mean lawful processing. Option B is incorrect because the information was not disclosed at the right time. Option D is incorrect because explicit consent is not necessarily required if another lawful basis applies.


Reference:

GDPR Article 6(1) (Lawfulness of processing)

GDPR Article 13(1) (Transparency in data processing)



Scenario: 2

Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number).
When the user clicks the email address box, a pop-up message appears as follows: "Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: "Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app.
When customers want to make a purchase, they are also required to provide their bank account details.
When the user finally creates the account, the following message appears: "Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following Questio n:

Questio n:

Based on scenario 2, Soyled only has three mandatory fields in its sign-up form. On which GDPR principle is this decision based?

  1. Lawfulness, fairness, and transparency
  2. Purpose limitation
  3. Data minimization
  4. Storage limitation

Answer(s): C

Explanation:

Under Article 5(1)(c) of GDPR, the data minimization principle states that personal data must be adequate, relevant, and limited to what is necessary for processing. Soyled's decision to have only three mandatory fields (name, surname, and email) aligns with data minimization since it only collects the minimum data needed for account creation. Option C is correct. Option A is incorrect as transparency relates to informing users. Option B is incorrect because purpose limitation focuses on using data only for specific purposes. Option D is incorrect because storage limitation concerns data retention periods.


Reference:

GDPR Article 5(1)(c) (Data minimization principle)

Recital 39 (Limiting data collection to necessity)



Scenario: 2

Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number).
When the user clicks the email address box, a pop-up message appears as follows: "Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: "Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app.
When customers want to make a purchase, they are also required to provide their bank account details.
When the user finally creates the account, the following message appears: "Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts,

and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following Questio n:

Questio n:

Based on scenario 2, is John's request eligible under GDPR?

  1. No, data subjects can request access to how their data is being collected but not details about its processing or storage.
  2. No, data subjects are not eligible to request details on the collection, storage, or processing of their personal data.
  3. Yes, data subjects have the right to request details on how their personal data is collected, stored, and processed.
  4. No, because John's data was collected based on legitimate interest.

Answer(s): C

Explanation:

Under Article 15 of GDPR, the Right of Access allows data subjects to request detailed information about:

The purpose of data processing

Categories of personal data collected

Data recipients

Storage duration

Rights to rectification and erasure

John's request is valid under GDPR, making Option C correct. Option A is incorrect because GDPR

grants full transparency. Option B is incorrect because data subjects must be informed upon request. Option D is incorrect because lawful basis does not override access rights.


Reference:

GDPR Article 15 (Right of Access)

Recital 63 (Transparency in personal data processing)



Scenario: 2

Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number).
When the user clicks the email address box, a pop-up message appears as follows: "Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: "Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app.
When customers want to make a purchase, they are also required to provide their bank account details.
When the user finally creates the account, the following message appears: "Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following Questio n:

Scenario:

Soyled's customers are required to provide their bank account details to buy a product. According to the GDPR, is this data processing lawful?

  1. Yes, because the processing is necessary for the fulfillment of the purchase agreement.
  2. Yes, because Soyled has a privacy policy in place that ensures the protection of personal data.
  3. No, sensitive data, such as bank account details, should only be processed by official authorities.
  4. No, because financial information cannot be collected without explicit consent.

Answer(s): A

Explanation:

Under Article 6(1)(b) of GDPR, processing is lawful if it is necessary for the performance of a contract with the data subject. Since the customers must provide bank details to complete their purchases, this processing is necessary for fulfilling the agreement.

Option A is correct because payment data is essential for transaction processing, which aligns with GDPR's contract basis.

Option B is incorrect because having a privacy policy does not automatically justify data processing.

Option C is incorrect because financial data can be processed by authorized commercial entities under GDPR.

Option D is incorrect because explicit consent is not required when processing is contractually necessary.


Reference:

GDPR Article 6(1)(b) (Processing necessary for contract performance)

Recital 44 (Necessity of processing for contract fulfillment)



  PDF
Viewing page 6 of 17
Viewing questions 26 - 30 out of 80 questions


Post your Comments and Discuss PECB GDPR exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!

© 2026 Free-Braindumps.com - A Community of Learners.

Free-Braindumps.com is owned by Xùnliàn Limited, a company registered at 15 Wang Chiu Rd, Kowloon Bay, Hong Kong.

The resources, practice tests, and study guides on Free-Braindumps.com are strictly for educational and research purposes. We are an independent community platform and are not affiliated with, endorsed by, or sponsored by any official certification vendors, including Microsoft, Cisco, Amazon, CompTIA, or others. All certification names, trademarks, and logos are the property of their respective owners. Our content is user-contributed or independently developed to assist with exam preparation and skill assessment; we do not host or provide access to proprietary, confidential, or live exam questions.