CIPT: Certified Information Privacy TechnologistDemo

By IAPP · Question Mode

QuestionQ55

Foundational Principles

Which of the following information must be included in documentation of records of processing activities for an organization that processes personal data on another organization’s behalf?

Choose two
  • A Copies of the consent forms from each data subject.
  • B Time limits for erasure of different categories of data.
  • C Contact details of the processor and Data Protection Offer (DPO).
  • D Descriptions of the processing activities and relevant data subjects.
Explanation

GDPR Article 30(2) requires a processor’s records to contain the processor’s and relevant controller’s contact details, including the data protection officer where applicable, and the categories of processing performed for each controller. It does not require copies of consent forms or retention/erasure time limits; the latter are associated with controller records under Article 30(1).

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!