CIPP/E: Certified Information Privacy Professional/EuropeDemo

By IAPP · Question Mode

QuestionQ110

Compliance with European Data Protection Law and Regulation

Under the GDPR, which action by Company B would NOT be likely to result in a potential enforcement action?

  • A Their omission of data protection provisions in their contract with Company C.
  • B Their failure to provide sufficient security safeguards to Company A’s data.
  • C Their engagement of Company C to improve their payroll service.
  • D Their decision to operate without a data protection officer.
Explanation

A processor may use another organisation to assist with processing, so engaging a provider to support improvement of a payroll service is not inherently unlawful. The processor must, however, obtain the controller’s required authorisation and put equivalent Article 28 data-protection obligations in place with that subprocessor. Processors also require appropriate security measures, and a DPO is mandatory where core activities involve large-scale processing of special-category data.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!