100% Free PDPF Practice Exam Questions and Answers

Stay Ahead with Latest PDPF Privacy and Data Protection Foundation Practice Test Questions 2026

Page: 1 / 30

Total 149 Questions | Updated On: Oct 24, 2026

Add To Cart

Question 1

Which data subject right is explicitly defined by the GDPR?

A : A copy of personal data must be provided in the format requested by the data subject.

B : Personal data must always be erased if the data subject requests this

C : Access to personal data must be provided free of charge for the data subject

D : Personal data must always be changed at the request of the data subject

Answer: C

Question 2

Who is responsible for demonstrating the compliance of personal data processing with the General Data Protection Regulation (GDPR)?

A : The Data Protection Officer (DPO)

B : The processor

C : The controller

D : The supervisory authority

Answer: C

Question 3

GDPR quotes in one of its principles that personal data should be adequate, relevant and limited to what is necessary in relation to its purpose. What principle is this?

A : integrity and confidentiality

B : purpose limitation

C : data minimization

D : lawfulness, loyalty and transparency

Answer: C

Question 4

A shopkeeper wants to register how many visitors enter his shop every day. A system detects the MAC-address of each visitor’s smartphone. It is impossible for the shopkeeper to identify the owner of the phone from this signal, but telephone providers can link the MAC-address to the owner of the phone. According to the GDPR, is the shopkeeper allowed to use this method?

A : Yes, because the shopkeeper cannot identify the owner of the telephone

B : No, because the telephone providers are the owners of the MAC-addresses

C : No, because the telephone’s MAC-address must be regarded as personal data

D : Yes, because the visitor has automatically consented by connecting to the Wi-Fi

Answer: C

Question 5

What is a description of data protection by design and by default?

A : Not holding more data than is strictly required for processing

B : An indication of timeframes if processing relates to erasure

C : Data may only be collected for explicit and legitimate purposes

D : An approach that implements data protection from the start (Correct)

Answer: D

Page: 1 / 30

Total 149 Questions | Updated On: Oct 24, 2026

Add To Cart