Exin PDPF Exam Dumps

Privacy is a right that must be protected, and Data Protection are the measures that will be used to achieve this protection.

Data protection and privacy complement each other, but they are not the same.

A well-known phrase is: ''You can have security without privacy, but you cannot have privacy without security''.

Recital 4 of the GDPR says:

The processing of personal data should be designed to serve individuals. The right to protection of personal data is not absolute; it must be considered in relation to its role in society and balanced with other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedom and principles recognized in the Charter, enshrined in the Treaties, namely respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom of business, the right to action and an impartial tribunal, and cultural, religious and linguistic diversity.

The front line with the data holder is the Controller, see image. So, it is he who has to show compliance, who must be concerned with the legality of processing, who must implement security measures.

Compulsory Corporate Rules are rules used internally by multinational companies to transfer personal data. Thus, it is possible to transfer data between them, even if the destination company is in a country that does not have an adequate level of data protection. These rules are like an internal corporate code of conduct and do not cover transfers of personal data outside the corporate group.

Do not confuse 'Compulsory Corporate Rules' with 'Standard Contractual Clauses'. The last are clauses in contracts for international data transfer between companies (customer and supplier relationship) where the destination country does not have an adequate level of data protection, and depends on authorization from the Supervisory Authority.

Article 58 of GDPR

3. supervisory authority shall have all of the following authorisation and advisory powers:

a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36.

An approach that implements data protection from the start. Correct. This is a correct description. (Literature: A, Chapter 8; GDPR Article 25(1))

An indication of timeframes if processing relates to erasure. Incorrect. This is a description of a data protection impact assessment (DPIA).

Data may only be collected for explicit and legitimate purposes. Incorrect. This is a description of measures taken to comply with the principle of purpose limitation.

Not holding more data than is strictly required for processing. Incorrect. This is a description of procedures to comply with the principle of data minimization.