PDPA Practice Quiz Bank — 175 Questions

Readable outline — open in a web browser (Safari/Chrome) for the interactive map.

PDPA Quiz Bank Singapore PDPA

Practice quiz built from Singapore PDPA Practice Question Bank plus two 50-question supplements. It covers Data Breach Management, DPIA, DPMP, and Risk Management across foundational, intermediate, advanced, and additional scenario questions.

Open a branch, choose a topic, then tap a question card to reveal the correct answer.

Foundational Q1-Q25

25 multiple-choice questions from foundational level. Open a topic set below and tap cards to reveal answers.

Breach Quiz Q1-Q7

7 questions covering Data Breach Management. Source range: Q1-Q7.

Answer distribution: A: 1, B: 5, C: 0, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q1. Under the PDPA, within how many calendar days must an organisation notify the PDPC of a notifiable data breach after assessing it to be notifiable?

A 30 days

B 3 calendar days

C 72 hours

D 24 hours

Q2. A data breach is “notifiable” if it meets either of two thresholds. One is “significant harm to affected individuals.” What is the other?

A The breach is of a significant scale (affects 500 or more individuals)

B The breach involves financial data only

C The breach involves more than 50 individuals

D The breach occurred outside Singapore

Q3. When an organisation assesses that a breach is likely to result in significant harm to individuals, it must notify:

A Only the PDPC

B Both the PDPC and the affected individuals

C Only the police

D Only its insurer

Q4. What is the FIRST priority action when a data breach is discovered?

A Pay compensation to individuals

B Contain the breach to limit further unauthorised access or loss

C Delete all logs

D Notify the media

Q5. Which document outlines an organisation's procedures for detecting, assessing, and responding to a data breach?

A Privacy policy of a third party

B Data Protection Notice

C Consent form

D Data Breach Management / Incident Response Plan

Q6. Which of the following is generally NOT considered “significant harm” triggering individual notification on its own?

A Disclosure of NRIC numbers

B Disclosure of a publicly listed business contact number

C Disclosure of financial / bank account information

D Disclosure of health/medical information

Q7. If a data intermediary discovers a breach affecting personal data it processes on behalf of another organisation, it must:

A Notify the affected individuals directly

B Notify the organisation (the controller) without undue delay

C Take no action — it is not responsible

D Notify the PDPC directly

DPIA Quiz Q8-Q13

6 questions covering Data Protection Impact Assessment (DPIA). Source range: Q8-Q13.

Answer distribution: A: 1, B: 0, C: 2, D: 3.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q8. A DPIA is best described as:

A A breach-assessment checklist used only after an incident has occurred

B A financial audit of the organisation

C A risk-based assessment that identifies, assesses, and addresses personal data protection risks

D A post-incident notification form used only after a breach has occurred

Q9. When is a DPIA most appropriately conducted?

A After a system has gone live and a breach has occurred

B Only when the PDPC requests it

C Only after receiving a complaint

D Before deploying a new system or making material changes to how personal data is handled

Q10. Which factor would most strongly indicate that a DPIA should be initiated?

A The project uses only anonymised public data

B The project has a small budget

C The project involves no personal data

D The processing involves sensitive personal data or operates at large scale

Q11. In the PDPC's DPIA guide, the sample DPIA questionnaire (Annex B) typically captures which three elements per item?

A Name, NRIC, and address

B Cost, deadline, and owner

C Question, response/description, and evidence/source

D Revenue, profit, and loss

Q12. A key benefit of conducting a DPIA is that it helps an organisation:

A Demonstrate accountability and reduce the likelihood of non-compliance before processing begins

B Document decisions only after the system has already gone live

C Bypass the consent obligation

D Eliminate the need for a DPO

Q13. Which phase is typically the FINAL step in a DPIA lifecycle?

A Assessing risks

B Scoping the project

C Identifying personal data flows

D Implementing and monitoring the risk-mitigation measures

DPMP Quiz Q14-Q19

6 questions covering Data Protection Management Programme (DPMP). Source range: Q14-Q19.

Answer distribution: A: 2, B: 4, C: 0, D: 0.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q14. A Data Protection Management Programme (DPMP) is primarily intended to help an organisation:

A Avoid appointing a DPO

B Establish policies, processes, and governance to systematically comply with the PDPA

C Increase advertising revenue

D Replace the need for staff training

Q15. Which of the following is a core component of a DPMP?

A A DPO appointed only after a data breach has occurred

B Governance structure and a designated DPO

C A privacy notice with no supporting internal controls or training

D An external marketing agency contract

Q16. Under the Accountability Obligation, organisations must:

A Only document policies if a breach occurs

B Develop and implement data protection policies and make information about them available

C Delegate all responsibility to customers

D Keep all data protection practices secret

Q17. The PDPC's “PATO” tool refers to:

A A privacy accountability checklist maintained by the organisation only

B PDPA Assessment Tool for Organisations (a self-assessment questionnaire)

C Personal Account Transfer Order

D Public Audit of Telecom Operators

Q18. A data inventory map within a DPMP is used to:

A Document what personal data is collected, where it is stored, and how it flows

B Track employee attendance

C List only third-party vendors without recording data locations or flows

D List the organisation's physical assets

Q19. Which obligation requires an organisation to appoint at least one individual responsible for ensuring PDPA compliance?

A Accountability Obligation (appointment of a DPO)

B Notification Obligation

C Retention Limitation Obligation

D Consent Obligation

Risk Quiz Q20-Q25

6 questions covering Risk Management. Source range: Q20-Q25.

Answer distribution: A: 1, B: 2, C: 1, D: 2.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q20. In data protection risk management, “risk” is generally assessed as a combination of:

A Volume of records involved and number of systems affected

B Revenue and headcount

C Likelihood of occurrence and severity of impact

D The number of systems involved and the volume of records only

Q21. Third-Party Risk Management (TPRM) under the PDPA is most concerned with:

A Risks from currency fluctuations

B Risks arising from vendors / data intermediaries handling personal data

C Physical building maintenance

D Marketing campaign performance

Q22. When engaging a data intermediary, an organisation should primarily manage risk by:

A Imposing contractual obligations requiring the intermediary to protect personal data

B Sharing all passwords openly

C Transferring all legal liability to the individual

D Avoiding any written agreement

Q23. Which of the following is a recognised risk-treatment strategy?

A Delete all compliance records

B Ignore, hide, deny, or delay

C Outsource all data to the public

D Mitigate, transfer, avoid, or accept the risk

Q24. The Protection Obligation requires organisations to make reasonable security arrangements. This is an example of which risk-treatment approach?

A Risk acceptance

B Risk transfer

C Risk avoidance

D Risk mitigation (applying controls/safeguards)

Q25. Regular review and monitoring of data protection controls is important because:

A Controls never need updating once set

B Risks evolve over time as systems, data, and threats change

C It eliminates the need for a DPMP

D The PDPA only applies once

Intermediate Q26-Q50

25 multiple-choice questions from intermediate level. Open a topic set below and tap cards to reveal answers.

Breach Quiz Q26-Q32

7 questions covering Data Breach Management. Source range: Q26-Q32.

Answer distribution: A: 3, B: 1, C: 1, D: 2.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q26. Mandatory data breach notification became a legal obligation under the PDPA following which amendment?

A Spam Control Act 2007

B PDPA (Amendment) Act 2020, in force 1 Feb 2021

C PDPA original enactment 2012

D Computer Misuse Act 2017

Q27. An organisation must conduct a breach assessment in a “reasonable and expeditious” manner. This means it should:

A Assess whether the breach is notifiable as soon as practicable after becoming aware

B Take as long as it wants

C Wait until the next financial year

D Only assess if an individual complains

Q28. Which is an example of a data breach caused by human error?

A A natural disaster destroying a server

B A vendor's certified secure deletion

C A ransomware attack by an external hacker

D An employee emailing a customer list to the wrong recipient

Q29. When notifying affected individuals of a breach, the notification should generally include:

A The categories of affected data without recommended protective steps

B A high-level statement that a breach occurred, without describing the data involved

C The names of all other affected organisations

D How the breach occurred, the data involved, and steps individuals can take to protect themselves

Q30. An organisation does NOT need to notify affected individuals if:

A It simply prefers not to

B The breach happened on a weekend

C It has taken remedial action that renders the significant harm unlikely, or the data was encrypted/protected

D Fewer than 10 staff are employed

Q31. Failure to comply with the data breach notification obligation can result in:

A Financial penalties imposed by the PDPC

B Automatic imprisonment of all staff

C Loss of company registration only

D No consequences

Q32. Keeping a breach register/log is recommended because it:

A Demonstrates accountability and supports investigation and reporting

B Records only incidents that resulted in formal notification

C Records only breaches that were already notified to affected individuals

D Replaces the need to notify the PDPC

DPIA Quiz Q33-Q38

6 questions covering Data Protection Impact Assessment (DPIA). Source range: Q33-Q38.

Answer distribution: A: 1, B: 1, C: 3, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q33. A company wants to deploy a new IT system that processes large volumes of personal data. The strongest reason to run a DPIA is:

A It is expensive

B Employees may dislike change

C The new system is high-risk and processes large volumes of personal data

D DPIAs are legally mandatory for all systems

Q34. Mapping personal data flows during a DPIA helps to:

A Identify where data is collected, used, disclosed, stored, and the associated risks

B Record only the storage location, without collection, use, or disclosure points

C Identify only where data is stored, without how it is used or disclosed

D Identify only the business owner of each system, not the data handled

Q35. Which stakeholders should ideally be involved in a DPIA?

A Only the business owner and DPO, without IT or legal input

B Cross-functional input — e.g., business owners, IT, legal/compliance, and the DPO

C Only the business unit that owns the project

D Only external customers

Q36. After identifying risks in a DPIA, the next logical step is to:

A Ignore them if the project is urgent

B Publish all risks publicly

C Determine and implement appropriate controls to mitigate the risks

D Cancel the project automatically

Q37. A DPIA supports the principle of “Privacy by Design” because it:

A Removes the need for consent

B Focuses solely on aesthetics

C Builds data protection considerations into projects from the outset

D Adds privacy only after launch

Q38. Which statement about DPIAs under the PDPA is correct?

A They must be filed with the police

B They are explicitly mandatory by law for every project

C They are illegal for SMEs

D They are strongly recommended by the PDPC as good practice for high-risk processing

DPMP Quiz Q39-Q44

6 questions covering Data Protection Management Programme (DPMP). Source range: Q39-Q44.

Answer distribution: A: 4, B: 2, C: 0, D: 0.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q39. A DPMP should be:

A A living programme that is regularly reviewed and updated

B A one-time document never reviewed again

C Kept hidden from all employees

D Outsourced entirely with no internal oversight

Q40. Staff training is part of a DPMP because:

A Employees are often the first line of defence and a common source of breaches

B It replaces the need for technical controls

C It reduces the need for a privacy policy

D Training is needed only for the DPO and senior management

Q41. Which document communicates to individuals how their personal data is collected, used, and disclosed?

A Vendor invoice

B Data Protection Notice / Privacy Policy

C Annual financial statement

D Employee payslip

Q42. An effective DPMP typically aligns its policies with how many key PDPA data protection obligations?

A Two

B Nine (the PDPA's main obligations)

C Twenty-five

D Fifty

Q43. Which of the following best reflects the “four-step” DPMP development approach often taught?

A Govern → Assess (Plan) → Implement (Protect) → Sustain (Review/Maintain)

B Hire → Fire → Rehire → Retire

C Collect → Hide → Forget → Repeat

D Buy → Sell → Trade → Profit

Q44. Demonstrating accountability through a DPMP can benefit an organisation by:

A Building consumer trust and reducing regulatory and reputational risk

B Removing the need for consent in all cases

C Guaranteeing zero breaches forever

D Exempting it from the PDPA

Risk Quiz Q45-Q50

6 questions covering Risk Management. Source range: Q45-Q50.

Answer distribution: A: 2, B: 1, C: 2, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q45. A risk register in data protection is used to:

A Record only completed mitigations, excluding pending actions and risk owners

B List only high-risk items and omit lower-rated risks from review

C Record identified risks, their likelihood, impact, owners, and mitigation status

D Record customer loyalty points

Q46. “Risk appetite” refers to:

A The amount of risk that remains after controls are implemented

B The amount and type of risk an organisation is willing to accept in pursuit of its objectives

C The number of vendors used

D The number of meals served at staff events

Q47. Conducting due diligence before appointing a data intermediary is an example of:

A Proactive third-party risk management

B Reactive vendor review after a breach has already occurred

C Ignoring risk

D Risk transfer to individuals

Q48. A residual risk is:

A The risk remaining after controls have been applied

B The risk before any assessment

C A risk that does not exist

D Only financial risk

Q49. Which is a technical safeguard that mitigates the risk of unauthorised data access?

A Disabling all logging

B Sharing admin accounts with all staff

C Encryption and access controls

D Posting passwords on a public website

Q50. Periodic risk assessments should be triggered by:

A Only when revenue increases

B Only once at company founding

C Never, if no complaints are received

D Significant changes to systems, processes, regulations, or after an incident

Advanced Scenarios Q51-Q75

25 multiple-choice questions from advanced scenarios level. Open a topic set below and tap cards to reveal answers.

Breach Quiz Q51-Q57

7 questions covering Data Breach Management. Source range: Q51-Q57.

Answer distribution: A: 0, B: 4, C: 1, D: 2.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q51. A retailer's database of 800 customers (names + email addresses only) is accessed by an unauthorised party. No financial, NRIC, or sensitive data is involved. Is this notifiable, and to whom?

A Not notifiable — emails are not sensitive

B Notifiable to individuals only

C Notifiable to the police only

D Notifiable to the PDPC only, because the breach meets the significant-scale threshold (≥500 individuals)

Significant scale is an independent trigger even if harm is low; PDPC notification is required, though individual notification may not be if significant harm is unlikely.

Q52. An organisation discovers a breach on Day 1, but cannot immediately tell if it is notifiable. It completes its assessment on Day 4 and concludes it IS notifiable. By when must it notify the PDPC?

A Within 30 days of discovery

B Within 3 calendar days of completing the assessment (i.e., by Day 7)

C No deadline applies once assessment is done

D By Day 4 (the day of assessment) — already late

The 3-day clock runs from when the organisation assesses the breach as notifiable, but the assessment itself must be expeditious.

Q53. A laptop containing customers' personal data is stolen, but the data was strongly encrypted and the decryption key was not compromised. The most defensible position is:

A Notify only the police and stop there

B Always notify both PDPC and individuals regardless

C No assessment is needed at all

D Significant harm is unlikely due to encryption, so individual notification may not be required — but assess and document the reasoning

Q54. A data intermediary suffers a breach and notifies the controlling organisation on Day 2. The 3-day notification clock for the PDPC, owed by the controller, generally begins when:

A The intermediary first detects the breach

B The controller has assessed the breach (after being informed) and determines it is notifiable

C Exactly 72 hours after the intermediary's detection

D The controller never has an obligation — only the intermediary does

Q55. Which scenario most clearly creates a presumption of “significant harm” requiring individual notification?

A Disclosure of a list of subscriber first names only

B Unauthorised disclosure of individuals' bank account numbers together with their identities

C Disclosure of a company's general enquiry email

D Disclosure of a customer’s general business email address only

Q56. An organisation argues it should delay notifying individuals because doing so would tip off the attacker during an active investigation. Under the PDPA framework, this:

A Permits indefinite secrecy with no documentation

B Is never permitted

C May justify a waiver/exception to individual notification on enforcement or remediation grounds, subject to PDPC's position

D Removes the obligation to notify the PDPC as well

Q57. Which post-incident action best supports the Accountability and Protection obligations?

A Deleting all breach logs to avoid liability

B Conducting a root-cause review and updating controls and the breach response plan

C Blaming the affected individuals

D Ignoring it since notification was filed

DPIA Quiz Q58-Q63

6 questions covering Data Protection Impact Assessment (DPIA). Source range: Q58-Q63.

Answer distribution: A: 2, B: 2, C: 1, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q58. A company wants to deploy facial-recognition for office access, repurposing CCTV footage. The strongest reason to run a DPIA first is:

A Employees may dislike cameras

B DPIAs are legally mandatory for all CCTV

C The new use is high-risk, involves potentially sensitive biometric data, and changes the original purpose of collection

D CCTV is expensive

Q59. During a DPIA, the team finds a process collects more data fields than necessary. The correct response aligned to PDPA principles is to:

A Sell the surplus data

B Apply data minimisation — collect only what is reasonably necessary for the stated purpose

C Keep collecting everything in case it's useful later

D Encrypt the extra data and keep it indefinitely

Q60. A DPIA concludes a project carries “high residual risk” even after controls. The most appropriate next step is to:

A Escalate to senior management/DPO for a risk-acceptance decision or further mitigation before go-live

B Proceed silently

C Cancel the DPIA

D Reduce the documentation

Q61. Which is the WEAKEST trigger, on its own, for conducting a DPIA?

A Deploying automated decision-making affecting individuals

B Sharing personal data with a new overseas vendor

C Large-scale processing of sensitive data

D A minor wording change to an internal memo not involving personal data

Q62. A vendor will process customer data overseas as part of a new system under DPIA review. The DPIA should specifically assess:

A Whether the transfer meets the PDPA Transfer Limitation Obligation (comparable protection abroad)

B Whether the vendor has a local implementation team

C Whether the vendor has appointed a relationship manager for the project

D Whether the vendor’s service interface supports privacy notices

Q63. The primary OUTPUT of a completed DPIA should be:

A A press release

B A documented record of risks, mitigation measures, decisions, and residual risk sign-off

C A checklist showing that the project team discussed privacy risks informally

D A staff bonus plan

DPMP Quiz Q64-Q69

6 questions covering Data Protection Management Programme (DPMP). Source range: Q64-Q69.

Answer distribution: A: 2, B: 2, C: 1, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q64. An organisation has a privacy policy but no data inventory, no breach plan, and no assigned DPO duties. Its most significant DPMP gap is:

A Having policies but no breach response process or data inventory

B A privacy notice with no supporting internal accountability records

C Lack of operational accountability structures (governance, data mapping, incident response)

D Having a privacy notice but no process to keep supporting records updated

Q65. A DPO is appointed but their name/contact is not made available to the public. This most directly breaches:

A The Accountability Obligation's requirement to make DPO business contact information available

B Notification Obligation

C Consent Obligation

D Retention Limitation

Q66. Under PDPA, appointing a DPO:

A Transfers all legal liability to the DPO personally

B Does not absolve the organisation of its own compliance responsibilities

C Removes the need for any policies

D Is optional and carries no expectation

Q67. Which is the BEST evidence that a DPMP is operating effectively, rather than merely existing on paper?

A Records of training, periodic reviews, incident drills, and updated risk assessments

B A policy approved once, with no evidence of training, review, or implementation

C A policy approval record with no evidence of ongoing implementation

D A thick policy binder no one reads

Q68. An organisation retains customers' personal data indefinitely “just in case.” This most directly conflicts with:

A No obligation at all

B The Retention Limitation Obligation (cease retention when purpose no longer served and no legal need)

C The Consent Obligation only

D The Notification Obligation only

Q69. Integrating data protection clauses into HR, procurement, and IT processes reflects which DPMP principle?

A Treating data protection as a siloed, one-department task

B Outsourcing all compliance

C Avoiding documentation

D Embedding accountability across the organisation's operations

Risk Quiz Q70-Q75

6 questions covering Risk Management. Source range: Q70-Q75.

Answer distribution: A: 1, B: 1, C: 2, D: 2.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q70. A risk has low likelihood but catastrophic impact (e.g., mass exposure of sensitive health data). The most prudent treatment is usually to:

A Ignore it

B Increase data collection

C Accept it because likelihood is low

D Apply strong mitigating controls and/or transfer mechanisms given the severe impact

Q71. An organisation relies on a cloud vendor's security but never reviews the vendor's controls or contract terms. The key risk-management failing is:

A Excessive staff training

B Over-documentation

C Inadequate third-party oversight / failure to verify and contractually bind the intermediary

D Too much encryption

Q72. “Inherent risk” differs from “residual risk” in that inherent risk is:

A The risk after all controls are applied

B The risk level before any controls/mitigation are applied

C Always zero

D Only relevant to finance

Q73. A risk assessment rates an item “Medium” but the DPO knows regulatory scrutiny on that data type is rising. The best practice is to:

A Lower the rating to reduce workload

B Delete the risk register

C Treat risk ratings as dynamic and re-evaluate in light of changing regulatory/threat context

D Never revisit the rating

Q74. Which control is BEST classified as an administrative (organisational) safeguard rather than a technical one?

A A documented access-authorisation policy and staff confidentiality undertakings

B Multi-factor authentication tokens

C Database encryption

D Network firewalls

Q75. When transferring personal data to a country without comparable data protection law, the most appropriate risk-mitigation measure is to:

A Proceed without conditions

B Rely solely on the recipient's goodwill

C Anonymise nothing and hope for the best

D Put in place contractual clauses/binding measures ensuring a comparable standard of protection

Additional Intermediate Q76-Q100

25 multiple-choice questions from the supplement. Open a topic set below and tap cards to reveal answers.

Breach Quiz Q76-Q81

6 questions covering Data Breach Management. Source range: Q76-Q81.

Answer distribution: A: 1, B: 2, C: 1, D: 2.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q76. Under the PDPA, a “data breach” includes which of the following?

A Only loss of paper records

B Unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data — or loss of a storage medium

C Only incidents affecting more than 500 people

D Only external hacking incidents

Q77. The mandatory data breach notification thresholds and prescribed categories are set out in:

A The Employment Act

B The Companies Act

C The Personal Data Protection (Notification of Data Breaches) Regulations 2021

D The Personal Data Protection Regulations on access and correction requests

Q78. An organisation may notify affected individuals of a notifiable breach:

A At the same time as, or after, notifying the PDPC

B Only before notifying the PDPC

C Only one year later

D Never

Q79. Even where a breach is NOT assessed as notifiable, an organisation may still choose to:

A Deny the breach occurred

B Notify affected individuals voluntarily as good practice

C Transfer liability to customers

D Destroy all evidence

Q80. Which is an example of personal data on the prescribed list deemed likely to cause significant harm if breached?

A A company's UEN

B An individual's full name only

C An individual’s business contact information used in a corporate role

D Credit card or debit card numbers together with related security data

Q81. For an organisation with annual turnover in Singapore exceeding S$10 million, the maximum financial penalty the PDPC may impose was raised to:

A A fixed S$1,000

B No penalty at all

C Up to 1% of global revenue

D Up to 10% of annual turnover in Singapore (or S$1 million, whichever is higher)

Higher of S$1 million or 10% of annual turnover in Singapore.

DPIA Quiz Q82-Q87

6 questions covering Data Protection Impact Assessment (DPIA). Source range: Q82-Q87.

Answer distribution: A: 1, B: 0, C: 1, D: 4.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q82. A DPIA is sometimes also referred to as a:

A Privacy Impact Assessment (PIA)

B Personnel Investment Audit

C Public Information Act filing

D Profit Impact Analysis

Q83. The FIRST step in a typical DPIA is to:

A Issue a press release

B Implement controls

C Notify the PDPC

D Scope the assessment and describe the project / information flows

Q84. A DPIA should be revisited when:

A Never, once completed

B Only at the company's financial year-end

C Only if a customer complains

D The project undergoes material change affecting personal data handling

Q85. If a planned process can achieve its purpose using fully anonymised data, the effect on DPIA scope is that:

A Consent is still always required

B The data becomes sensitive

C The DPIA must be longer

D Personal data protection risks are reduced, as anonymised data falls outside the PDPA's personal data scope

Q86. Sign-off / approval of a DPIA's findings and residual risk should ideally rest with:

A The project manager alone, regardless of authority to accept risk

B Any junior intern

C An external customer

D Senior management and/or the DPO who can accept or escalate the risk

Q87. A DPIA should also consider data retention and disposal because:

A Retention has no privacy impact

B Disposal is never relevant

C Holding data longer than necessary increases exposure and conflicts with the Retention Limitation Obligation

D Only collection matters

DPMP Quiz Q88-Q94

7 questions covering Data Protection Management Programme (DPMP). Source range: Q88-Q94.

Answer distribution: A: 0, B: 1, C: 4, D: 2.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q88. Under the PDPA, if an organisation cannot respond to an access request within a certain period, it must inform the individual of the time by which it will respond. That benchmark period is:

A 1 year

B 7 days

C 30 days

D 3 days

Q89. The Accuracy Obligation under the PDPA requires an organisation to:

A Keep data secret from the individual

B Make a reasonable effort to ensure personal data is accurate and complete if likely to be used to make a decision affecting the individual or disclosed to another organisation

C Guarantee data is never wrong

D Collect as much data as possible

Q90. “Deemed consent” under the PDPA may arise when:

A The organisation guesses the individual's wishes

B Consent is never required

C An individual voluntarily provides personal data for a purpose that is reasonably obvious in the circumstances

D The data is sold to a third party

Q91. The Do Not Call (DNC) provisions of the PDPA primarily govern:

A The collection of personal data through online web forms

B International shipping

C Email server configuration

D The sending of marketing messages (voice calls, texts, faxes) to Singapore telephone numbers

Q92. A robust DPMP should include a documented process for:

A Deleting audit trails

B Ignoring customer queries

C Handling individuals' complaints and access/correction requests

D Hiding data from regulators

Q93. The Purpose Limitation Obligation requires that an organisation collects, uses, or discloses personal data only:

A For any purpose it wishes

B For purposes that are operationally convenient but not notified to individuals

C Without any limitation

D For purposes a reasonable person would consider appropriate in the circumstances, and for which consent was (or is deemed) given

Q94. Periodic internal audits within a DPMP serve mainly to:

A Replace the DPO

B Avoid documentation

C Verify that policies are actually followed and identify gaps for continuous improvement

D Confirm that policies exist, even if staff do not follow them

Risk Quiz Q95-Q100

6 questions covering Risk Management. Source range: Q95-Q100.

Answer distribution: A: 3, B: 1, C: 2, D: 0.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q95. A risk matrix (heat map) plots risks according to:

A Volume of personal data against number of authorised users

B Revenue against cost

C Likelihood against impact, to prioritise treatment

D Staff age against tenure

Q96. The “principle of least privilege” means:

A Granting users only the minimum access rights needed to perform their role

B Giving everyone administrator access

C Removing all access for everyone

D Sharing one login among all staff

Q97. A data classification scheme (e.g., public, internal, confidential, restricted) supports risk management by:

A Ensuring controls are applied proportionately to the sensitivity of the data

B Eliminating the need for encryption

C Increasing data collection

D Making all data public

Q98. Assigning a “risk owner” to each identified risk is important because:

A Risks do not need owners

B It spreads blame anonymously

C It establishes clear accountability for monitoring and treating that risk

D It removes the need for a risk register

Q99. Vendor risk tiering (classifying vendors by the sensitivity/volume of data they handle) allows an organisation to:

A Treat all vendors identically regardless of risk

B Apply more rigorous due diligence and controls to higher-risk vendors

C Avoid contracts entirely

D Ignore overseas vendors

Q100. A business continuity / disaster recovery plan contributes to data protection risk management by:

A Ensuring the availability and recoverability of personal data after a disruptive incident

B Replacing the need for consent

C Eliminating the DPO role

D Increasing the likelihood of breaches

Additional Advanced Q101-Q125

25 multiple-choice questions from the supplement. Open a topic set below and tap cards to reveal answers.

Breach Quiz Q101-Q107

7 questions covering Data Breach Management. Source range: Q101-Q107.

Answer distribution: A: 1, B: 2, C: 4, D: 0.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q101. A hospital's system is breached, exposing 200 patients' diagnoses and treatment records. Although below 500 individuals, the organisation should:

A Notify the PDPC and affected individuals, because health data is likely to cause significant harm regardless of scale

B Do nothing

C Treat it as not notifiable because it is under 500

D Notify only its insurer

Q102. An employee reports that a phishing email may have exposed credentials, but it is unclear whether personal data was actually accessed. The DPO should FIRST:

A Immediately file a PDPC notification before any assessment

B Contain the threat and investigate/assess scope to determine whether a notifiable breach has occurred

C Wait 30 days before acting

D Delete the email and move on

Q103. A vendor processing payroll data for Company X is breached. Company X argues it bears no responsibility since the vendor caused it. The correct position is:

A Neither party is responsible

B Company X, as the organisation, remains accountable under the PDPA and must assess and notify as required

C The employees are responsible

D Only the vendor is liable for everything

Q104. A breach affects 1,000 individuals, of whom 300 are based overseas. Regarding PDPC notification:

A The breach is automatically not notifiable

B No notification is needed because some are overseas

C The organisation still notifies the PDPC; PDPA obligations apply to its handling of personal data in Singapore

D Only the overseas regulator is notified

Q105. After a notifiable breach, an organisation notifies the PDPC but deliberately omits notifying affected individuals despite likely significant harm and no applicable exception. This is:

A Acceptable practice

B Required by law

C A breach of the notification obligation that may attract enforcement action

D Only a minor formatting issue

Q106. Which combination would MOST likely make a single breach notifiable on BOTH grounds (scale AND significant harm)?

A A single public press release

B An internal typo in a memo

C 600 individuals' NRIC numbers and bank account details exposed

D 3 individuals' first names exposed

Q107. The MOST important reason to preserve logs and forensic evidence after a breach is to:

A Avoid notifying anyone

B Increase storage costs

C Support accurate root-cause analysis, regulatory reporting, and remediation

D Support a decision to delete affected data immediately after notification

DPIA Quiz Q108-Q113

6 questions covering Data Protection Impact Assessment (DPIA). Source range: Q108-Q113.

Answer distribution: A: 1, B: 0, C: 1, D: 4.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q108. A bank plans to use AI to auto-approve loan applications using personal and financial data. A DPIA is critical mainly because:

A AI is fashionable

B It will reduce staff headcount

C The processing uses new technology but no personal or financial data

D The processing involves automated decisions with significant effects and sensitive financial data

Q109. Midway through a DPIA, the scope expands to include a new data-sharing arrangement with a marketing partner. The DPIA should:

A Be updated to reassess the new flows and risks before proceeding

B Be deleted

C Continue unchanged

D Be frozen and ignored

Q110. A project team claims, “We already did a DPIA two years ago, so we don't need another.” The system has since migrated to a new overseas cloud provider. The best response is:

A Append a short addendum without reassessing overseas-transfer risks

B Reuse the old DPIA verbatim

C Skip the DPIA entirely

D Conduct a fresh/updated DPIA, because material changes (overseas hosting, new processor) introduce new risks

Q111. A DPIA finds that staff can access far more customer records than their role requires. The most appropriate mitigation is:

A Give everyone full access for convenience

B Disable all access

C Ignore it

D Implement role-based access controls and least-privilege restrictions

Q112. The DPIA recommends pseudonymising a dataset used for analytics. The main privacy benefit is:

A Eliminating the need for any security

B Increasing the number of data fields collected

C Reducing the risk of identifying individuals while retaining analytical utility

D Making the data permanently public

Q113. A DPIA's residual risk is rated “Low” after controls, but the project owner now wants to add an unrelated secondary use of the data that was not assessed. The correct action is:

A Delete the DPIA record

B Proceed without review since residual risk was Low

C Hide the new use

D Re-assess the new secondary use under Purpose Limitation before implementing it

DPMP Quiz Q114-Q119

6 questions covering Data Protection Management Programme (DPMP). Source range: Q114-Q119.

Answer distribution: A: 0, B: 4, C: 1, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q114. An individual requests access to the personal data an organisation holds about them. The organisation should:

A Refuse all access requests

B Provide the personal data and information about its use/disclosure within a reasonable time, unless an exception applies

C Charge an unreasonable fee to deter the request

D Delete the data to avoid responding

Q115. An organisation discovers its published privacy notice no longer reflects a new data-sharing practice. Under a sound DPMP it should:

A Stop publishing any notice

B Update the internal policy only, without notifying affected individuals

C Keep the outdated notice

D Update the Data Protection Notice and ensure a valid basis (e.g., consent) for the new practice

Q116. A staff member asks why the company appoints a DPO when “the IT team already handles security.” The best explanation is:

A The DPO has no real function

B The DPO oversees overall PDPA compliance and accountability, which is broader than IT security alone

C The DPO only fixes computers

D The DPO replaces the IT team

Q117. During an annual DPMP review, the DPO finds staff training was last conducted three years ago. The recommended action is:

A Cancel training permanently

B Refresh and schedule regular staff training as part of ongoing accountability

C Train only staff who handle customer-facing complaints

D Outsource the entire workforce

Q118. An organisation keeps marketing consent records but cannot show when or how consent was obtained. This weakness most affects its ability to:

A Show that consent records exist, but not whether consent was validly obtained

B Improve product design

C Demonstrate valid consent and accountability if challenged

D Increase sales automatically

Q119. A customer withdraws consent for marketing. A compliant DPMP process ensures the organisation:

A Ignores the request

B Ceases the relevant use/disclosure within a reasonable time and records the withdrawal

C Ceases only new campaigns while allowing existing scheduled disclosures to continue

D Charges a penalty for withdrawal

Risk Quiz Q120-Q125

6 questions covering Risk Management. Source range: Q120-Q125.

Answer distribution: A: 3, B: 0, C: 0, D: 3.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q120. An organisation stores sensitive records in an unlocked cabinet in a public-facing area. This is primarily a deficiency in:

A Physical safeguards

B Administrative safeguards

C Technical safeguards

D Brand identity

Q121. A penetration test reveals an exploitable vulnerability in a customer portal. The risk-based response is to:

A Prioritise remediation according to the severity and likelihood of exploitation

B Publish the vulnerability publicly first

C Disable all logging

D Ignore it because a test found it, not a real attacker

Q122. Segregation of duties (e.g., the person who approves access is not the same person who grants it) reduces the risk of:

A Fraud, error, and unchecked privilege abuse

B Delayed removal of outdated personal data

C A delay in processing access requests

D Higher revenue

Q123. An organisation's contract with a data intermediary has no audit or security-review rights. The key risk-management gap is:

A Too many meetings

B Excessive transparency

C Over-encryption

D Inability to verify the intermediary's ongoing compliance and controls

Q124. Choosing to buy cyber-insurance to cover potential breach costs is an example of which risk-treatment approach?

A Risk acceptance with no action

B Risk elimination

C Risk avoidance

D Risk transfer

Q125. An organisation accepts a low residual risk after applying reasonable controls and documents the decision. This is an example of:

A Ignoring the risk

B Negligence

C Risk avoidance

D Informed risk acceptance within the organisation's risk appetite

Supplement 2 Intermediate Q126-Q150

25 multiple-choice questions from supplement 2. Open a topic set below and tap cards to reveal answers.

Breach Quiz Q126-Q131

6 questions covering Data Breach Management. Source range: Q126-Q131.

Answer distribution: A: 0, B: 1, C: 4, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q126. When notifying the PDPC of a data breach, the organisation should provide:

A Only the fact that a breach occurred and the date it was discovered

B Only the number of affected individuals, without impact or remediation details

C The known facts of the breach, its potential impact, and the remediation actions taken or planned

D A marketing brochure

Q127. Responsibility for determining whether a breach is notifiable rests with:

A The PDPC alone

B The data intermediary alone, even where the organisation controls the purposes

C The organisation (data controller), even if a data intermediary detected it

D The individual affected

Q128. The PDPC generally regards which period as a reasonable timeframe within which an organisation should establish whether a breach is notifiable?

A There is no expectation of timeliness

B Up to 2 years

C Exactly 1 hour

D Up to 30 days from becoming aware of a potential breach

Q129. Conducting periodic data breach simulation (“tabletop”) exercises primarily helps an organisation to:

A Increase advertising revenue

B Avoid appointing a DPO

C Test and improve the readiness of its breach response plan

D Eliminate the need for encryption

Q130. A breach response is often described in phases. Which sequence is correct?

A Notification → deletion → denial

B Containment → eradication → recovery → post-incident review

C Ignore → wait → repeat

D Assessment → public statement → recovery → optional containment

Q131. Organisations in regulated sectors (e.g., banking) may need to report a breach:

A Only through a public notice on the organisation’s website

B To no one

C To the PDPC and also to their sectoral regulator under separate obligations

D Only to their sectoral regulator, because sector rules replace PDPA duties

DPIA Quiz Q132-Q137

6 questions covering Data Protection Impact Assessment (DPIA). Source range: Q132-Q137.

Answer distribution: A: 2, B: 1, C: 1, D: 2.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q132. A preliminary “threshold assessment” in the DPIA process is used to:

A Decide whether a full DPIA is necessary for a given project

B Decide whether the project needs a data breach notification

C Decide whether the organisation needs to appoint a DPO

D Set staff salaries

Q133. A valid outcome of a DPIA may be a recommendation to:

A Hide the risks from management

B Not proceed with the project if risks cannot be adequately mitigated

C Collect more data than necessary

D Always proceed regardless of risk

Q134. When a DPIA assesses a project that relies on an external processor, it should also evaluate:

A The processor’s standard uptime commitments only

B The processor’s ability to provide standard service-level reports

C The processor's security arrangements and contractual safeguards

D The processor’s general business reputation without reviewing security controls

Q135. Embedding a DPIA trigger into an organisation's project/change-management process ensures that:

A DPIAs are only done after incidents

B DPIAs are never required

C Projects skip risk assessment

D Privacy risks are assessed early, before new processing goes live

Q136. Maintaining a register of DPIAs conducted supports:

A A register of only completed projects with no residual-risk decisions

B Reduced transparency

C A list of projects that were approved without privacy review

D Accountability and consistent tracking of privacy-risk decisions across projects

Q137. A DPIA on a customer-profiling/analytics project should pay particular attention to:

A Whether profiling could lead to unfair, intrusive, or unexpected outcomes for individuals

B Whether profiling outputs can be retained for future unrelated analysis

C Whether profiling results can be kept indefinitely for future use

D Whether analytics outputs can be shared internally without access controls

DPMP Quiz Q138-Q144

7 questions covering Data Protection Management Programme (DPMP). Source range: Q138-Q144.

Answer distribution: A: 2, B: 1, C: 3, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q138. The Correction Obligation under the PDPA requires an organisation to:

A Refuse all correction requests

B Charge a high fee for corrections

C Correct an error or omission in an individual's personal data upon request (subject to exceptions) and, where appropriate, send the correction to other organisations

D Delete all data instead

Q139. The Transfer Limitation Obligation requires that personal data transferred overseas is protected by:

A A verbal promise only

B A standard of protection comparable to the PDPA (e.g., via contractual clauses, certification, or binding corporate rules)

C Public disclosure

D No safeguards at all

Q140. The Notification Obligation (purpose notification) — distinct from breach notification — requires an organisation to:

A Notify individuals only after personal data has already been collected

B Notify the police of all data collection

C Publish all customer data

D Inform individuals of the purposes for collection, use, or disclosure at or before the time of collection

Q141. The Data Protection Trustmark (DPTM) is:

A A mandatory licence required before collecting any personal data

B A type of antivirus software

C A voluntary certification demonstrating sound data protection practices

D A marketing slogan with no standards

Q142. The PDPC's guidance on NRIC numbers generally advises organisations to:

A Avoid indiscriminately collecting, using, or disclosing NRIC numbers unless required by law or necessary

B Publish NRIC numbers publicly

C Use NRIC numbers as default customer identifiers

D Collect NRIC numbers from everyone for any reason

Q143. Secure disposal of personal data (e.g., shredding, secure deletion) primarily supports which obligations?

A The Retention Limitation and Protection Obligations

B The Accuracy and Notification Obligations

C The Accuracy and Access Obligations

D The Do Not Call registry

Q144. “Tone at the top” — visible senior management commitment — is important to a DPMP because it:

A Replaces the need for any policies

B Applies only after the PDPC starts an investigation

C Drives an organisational culture of accountability and proper resourcing for data protection

D Only matters to the marketing team

Risk Quiz Q145-Q150

6 questions covering Risk Management. Source range: Q145-Q150.

Answer distribution: A: 2, B: 0, C: 3, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q145. Key Risk Indicators (KRIs) are used to:

A Provide early-warning metrics that signal increasing risk exposure

B Replace a risk register by assigning one score to the whole organisation

C Provide historical incident totals without showing current risk exposure

D Provide final confirmation that all risk has been eliminated

Q146. Multi-factor authentication (MFA) reduces risk by:

A Requiring more than one form of verification, reducing the impact of compromised passwords

B Publishing credentials

C Sharing passwords across staff

D Removing all authentication

Q147. Periodic user access reviews (recertification) help to:

A Increase the number of admin accounts

B Disable encryption

C Ensure access rights remain appropriate and revoke those no longer needed

D Eliminate the DPO

Q148. The “three lines of defence” model assigns risk responsibilities to:

A The board, external vendors, and affected individuals

B Senior management, the DPO, and external counsel only

C The DPO, IT security team, and customer service team only

D Operational management, risk/compliance functions, and internal audit

Q149. Data Loss Prevention (DLP) tools primarily mitigate the risk of:

A Unauthorised changes to access permissions

B Unauthorised changes to privacy notices

C Unauthorised exfiltration or leakage of sensitive personal data

D Delayed responses to access and correction requests

Q150. Encryption “at rest” and “in transit” addresses the risk of:

A Employee tardiness

B Retention of personal data beyond the stated purpose

C Unauthorised access to stored data and interception of data being transmitted

D Excessive documentation

Supplement 2 Advanced Q151-Q175

25 multiple-choice questions from supplement 2. Open a topic set below and tap cards to reveal answers.

Breach Quiz Q151-Q157

7 questions covering Data Breach Management. Source range: Q151-Q157.

Answer distribution: A: 3, B: 0, C: 1, D: 3.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q151. A company restores breached data from backups within an hour and believes no copies were exfiltrated. Regarding notification:

A Notification is never required if data is restored

B Only the backup vendor must notify

C It can ignore the incident entirely

D It must still assess whether the breach was notifiable — quick recovery does not automatically remove the obligation, especially if data may have been accessed

Q152. An organisation's data intermediary detects a breach but takes three weeks to inform the organisation, delaying assessment. The PDPA expectation is that:

A The three-week delay is always acceptable

B The intermediary has no duty to inform anyone

C The intermediary should notify the organisation without undue delay so it can meet its assessment and notification duties

D The organisation is exempt because the intermediary was slow

Q153. After a breach, a company issues a public holding statement that downplays the incident and contradicts what it told the PDPC. The main risk is:

A Reducing the need to preserve forensic evidence

B Reduced legal exposure

C An automatic penalty waiver

D Undermining trust and inviting additional regulatory scrutiny for misleading communications

Q154. A breach exposes encrypted personal data, but the encryption keys were stored on the same compromised system. The organisation should:

A Ignore the breach

B Notify only the key vendor

C Treat the data as fully protected because it was “encrypted”

D Assume the data may be readable and assess notifiability accordingly

Q155. Two related incidents — a phishing compromise and a subsequent unauthorised data download — are discovered. Best practice is to:

A Assess them together as a connected breach to understand the full scope and impact

B Wait for a third incident

C Report only the phishing email

D Treat the download as unrelated and ignore it

Q156. An organisation argues that because affected individuals “probably won't notice,” it need not notify them. This reasoning is:

A Invalid — the test is whether the breach is likely to result in significant harm, not whether individuals will notice

B A sound legal defence

C Required by the PDPA

D Recommended by the PDPC

Q157. Following repeated similar breaches, the MOST effective accountability response is to:

A Conduct systemic root-cause analysis and strengthen governance — not just patch the latest incident

B Stop keeping breach records

C Blame individual junior staff only

D Update only the most recent control failure and close the incident

DPIA Quiz Q158-Q163

6 questions covering Data Protection Impact Assessment (DPIA). Source range: Q158-Q163.

Answer distribution: A: 1, B: 3, C: 1, D: 1.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q158. A retailer wants to deploy in-store Wi-Fi tracking to profile shopper movement using device identifiers. A DPIA should focus on:

A Whether individuals are adequately informed and whether the tracking is proportionate and minimised

B Whether raw movement trails can be retained for future operational analytics

C Whether individuals can access the Wi-Fi without creating an account

D The number of car-park lots

Q159. During a DPIA, legal/compliance flags that the proposed processing lacks a clear lawful basis (consent or an applicable exception). The project should:

A Proceed and seek consent afterwards

B Be hidden from the DPO

C Pause until a valid basis is established or the design is changed

D Ignore the legal concern

Q160. A DPIA for a data-analytics platform recommends aggregating data so individuals cannot be singled out. This control reflects:

A Removing all security

B Data minimisation and reduction of re-identification risk

C Publishing raw data

D Maximising data collection

Q161. A vendor offers a “free” analytics tool that will also use the organisation's customer data for the vendor's own purposes. A DPIA should treat this as:

A A reason to share more data

B A harmless convenience

C Irrelevant to privacy

D A significant risk requiring scrutiny of secondary use, consent, and disclosure to a third party

Q162. The DPIA finds residual risk acceptable, but only if a specific control (e.g., access logging) is implemented. That control should be:

A Treated as optional

B Treated as a mandatory condition and tracked to completion before/at go-live

C Documented and then ignored

D Removed to save effort

Q163. An organisation conducts a DPIA but never implements the agreed mitigations. In an enforcement context this:

A Is best practice

B Weakens its accountability position, since a DPIA is only effective if its recommendations are acted upon

C Eliminates all risk

D Fully protects the organisation

DPMP Quiz Q164-Q169

6 questions covering Data Protection Management Programme (DPMP). Source range: Q164-Q169.

Answer distribution: A: 3, B: 1, C: 2, D: 0.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q164. An individual asks an organisation to correct their address, but the organisation believes the existing record is correct. It should:

A Charge a penalty

B Consider the request, and if it does not make the correction, annotate the data with the correction sought (subject to PDPA rules)

C Ignore the request entirely

D Delete the individual's entire record

Q165. An organisation wants to use customer data collected for order fulfilment to now train a marketing AI model. Under the DPMP it should:

A Assess whether this new purpose requires fresh consent or falls within an applicable basis under Purpose Limitation

B Proceed without any review

C Assume original consent covers all future purposes

D Hide the new use from customers

Q166. A multinational wants to transfer Singapore customer data to an overseas affiliate. A compliant DPMP approach is to:

A Rely on the affiliate's goodwill

B Publicly post the data

C Put in place contractual clauses or binding measures ensuring comparable protection, satisfying the Transfer Limitation Obligation

D Transfer freely with no safeguards

Q167. An HR department stores employees' personal data. Under the DPMP, such employee personal data:

A Is also subject to PDPA obligations and should be protected and managed accordingly

B Needs no protection

C Is entirely outside the PDPA

D Can be shared freely with anyone

Q168. A customer complains that they keep receiving marketing despite unsubscribing. A well-designed DPMP would reveal a failure in:

A The consent-withdrawal handling process and associated records

B The privacy notice wording, without checking operational suppression lists

C The organisation’s access request workflow

D The annual tax return

Q169. To demonstrate accountability to the PDPC during an investigation, the MOST useful artefacts are:

A A list of systems used by the organisation, without controls or review evidence

B An unsigned privacy policy and a list of system owners

C Documented policies, training records, DPIAs, breach logs, and evidence of periodic reviews

D A public statement that the organisation takes privacy seriously

Risk Quiz Q170-Q175

6 questions covering Risk Management. Source range: Q170-Q175.

Answer distribution: A: 1, B: 2, C: 1, D: 2.

Tap any card to reveal the correct answer. All answer choices stay visible for active recall.

Q170. An employee with legitimate access copies a large volume of customer data to a personal USB drive before resigning. This illustrates:

A Accidental disclosure caused by external misdirection only

B Insider threat, mitigated by access controls, monitoring, and DLP

C A purely external hacking risk

D An external threat only, mitigated mainly by perimeter firewalls

Q171. Failing to apply security patches to a known-vulnerable server is primarily a deficiency in:

A Brand strategy

B Patch / vulnerability management

C Incident communications management

D Customer loyalty programmes

Q172. Enabling detailed logging and monitoring of access to personal data supports risk management by:

A Enabling detection of, and investigation into, unauthorised or anomalous activity

B Replacing the need for consent

C Increasing the volume of logs without review or alerting procedures

D Slowing down the network for fun

Q173. A “bring your own device” (BYOD) policy increases data protection risk mainly because:

A It eliminates the need for encryption

B It primarily affects only physical document retention

C It reduces all risk automatically

D Personal data may reside on unmanaged personal devices with weaker controls

Q174. Quantitative risk assessment differs from qualitative assessment in that it:

A Uses descriptive ratings such as High, Medium, and Low only

B Ignores likelihood entirely

C Is never used in data protection

D Assigns numeric values (e.g., probability and financial impact) rather than only descriptive High/Medium/Low ratings

Q175. Regularly testing data backups by performing trial restorations mitigates the risk that:

A Backups contain more data than the production system

B Backups exceed the retention schedule even when restoration is successful

C Backups are corrupt or unusable when actually needed for recovery

D Backups are too fast

Quick Rules Study prompts

Short reminders distilled from the question bank. Use these before opening the quiz sets.

Breach Triggers Notification

Notify the PDPC within 3 calendar days after assessing a breach as notifiable.
A breach is notifiable if it is likely to cause significant harm or is of significant scale affecting 500 or more individuals.
Contain first, assess promptly, document the reasoning, and review controls after the incident.

DPIA Signals Risk assessment

Run a DPIA before high-risk new systems, material changes, sensitive data processing, large-scale processing, or overseas vendor processing.
Map personal-data flows, assess risks, decide controls, and record residual-risk sign-off.
DPIA supports privacy by design by addressing risks before go-live.

DPMP Evidence Accountability

A DPMP is a living programme: governance, policies, processes, training, review, and improvement.
Accountability includes appointing a DPO and making DPO business contact information available.
Good evidence includes training records, reviews, incident drills, data inventories, and updated risk assessments.

Risk Lens Likelihood × impact

Risk combines likelihood and severity of impact.
Common treatments are mitigate, transfer, avoid, or accept.
Residual risk remains after controls; inherent risk exists before controls.
Vendor due diligence and contractual safeguards are central to third-party risk management.

Answer Key All answers

Answers are grouped by part. Open a range below for quick checking.

Foundational Key Q1-Q25

Consolidated answers from the current shuffled option order.

Q1: B Breach
Q2: A Breach
Q3: B Breach
Q4: B Breach
Q5: D Breach
Q6: B Breach
Q7: B Breach
Q8: C DPIA
Q9: D DPIA
Q10: D DPIA
Q11: C DPIA
Q12: A DPIA
Q13: D DPIA
Q14: B DPMP
Q15: B DPMP
Q16: B DPMP
Q17: B DPMP
Q18: A DPMP
Q19: A DPMP
Q20: C Risk
Q21: B Risk
Q22: A Risk
Q23: D Risk
Q24: D Risk
Q25: B Risk

Intermediate Key Q26-Q50

Consolidated answers from the current shuffled option order.

Q26: B Breach
Q27: A Breach
Q28: D Breach
Q29: D Breach
Q30: C Breach
Q31: A Breach
Q32: A Breach
Q33: C DPIA
Q34: A DPIA
Q35: B DPIA
Q36: C DPIA
Q37: C DPIA
Q38: D DPIA
Q39: A DPMP
Q40: A DPMP
Q41: B DPMP
Q42: B DPMP
Q43: A DPMP
Q44: A DPMP
Q45: C Risk
Q46: B Risk
Q47: A Risk
Q48: A Risk
Q49: C Risk
Q50: D Risk

Advanced Scenarios Key Q51-Q75

Consolidated answers from the current shuffled option order.

Q51: D Breach
Q52: B Breach
Q53: D Breach
Q54: B Breach
Q55: B Breach
Q56: C Breach
Q57: B Breach
Q58: C DPIA
Q59: B DPIA
Q60: A DPIA
Q61: D DPIA
Q62: A DPIA
Q63: B DPIA
Q64: C DPMP
Q65: A DPMP
Q66: B DPMP
Q67: A DPMP
Q68: B DPMP
Q69: D DPMP
Q70: D Risk
Q71: C Risk
Q72: B Risk
Q73: C Risk
Q74: A Risk
Q75: D Risk

Additional Intermediate Key Q76-Q100

Consolidated answers from the current shuffled option order.

Q76: B Breach
Q77: C Breach
Q78: A Breach
Q79: B Breach
Q80: D Breach
Q81: D Breach
Q82: A DPIA
Q83: D DPIA
Q84: D DPIA
Q85: D DPIA
Q86: D DPIA
Q87: C DPIA
Q88: C DPMP
Q89: B DPMP
Q90: C DPMP
Q91: D DPMP
Q92: C DPMP
Q93: D DPMP
Q94: C DPMP
Q95: C Risk
Q96: A Risk
Q97: A Risk
Q98: C Risk
Q99: B Risk
Q100: A Risk

Additional Advanced Key Q101-Q125

Consolidated answers from the current shuffled option order.

Q101: A Breach
Q102: B Breach
Q103: B Breach
Q104: C Breach
Q105: C Breach
Q106: C Breach
Q107: C Breach
Q108: D DPIA
Q109: A DPIA
Q110: D DPIA
Q111: D DPIA
Q112: C DPIA
Q113: D DPIA
Q114: B DPMP
Q115: D DPMP
Q116: B DPMP
Q117: B DPMP
Q118: C DPMP
Q119: B DPMP
Q120: A Risk
Q121: A Risk
Q122: A Risk
Q123: D Risk
Q124: D Risk
Q125: D Risk

Supplement 2 Intermediate Key Q126-Q150

Consolidated answers from the current shuffled option order.

Q126: C Breach
Q127: C Breach
Q128: D Breach
Q129: C Breach
Q130: B Breach
Q131: C Breach
Q132: A DPIA
Q133: B DPIA
Q134: C DPIA
Q135: D DPIA
Q136: D DPIA
Q137: A DPIA
Q138: C DPMP
Q139: B DPMP
Q140: D DPMP
Q141: C DPMP
Q142: A DPMP
Q143: A DPMP
Q144: C DPMP
Q145: A Risk
Q146: A Risk
Q147: C Risk
Q148: D Risk
Q149: C Risk
Q150: C Risk

Supplement 2 Advanced Key Q151-Q175

Consolidated answers from the current shuffled option order.

Q151: D Breach
Q152: C Breach
Q153: D Breach
Q154: D Breach
Q155: A Breach
Q156: A Breach
Q157: A Breach
Q158: A DPIA
Q159: C DPIA
Q160: B DPIA
Q161: D DPIA
Q162: B DPIA
Q163: B DPIA
Q164: B DPMP
Q165: A DPMP
Q166: C DPMP
Q167: A DPMP
Q168: A DPMP
Q169: C DPMP
Q170: B Risk
Q171: B Risk
Q172: A Risk
Q173: D Risk
Q174: D Risk
Q175: C Risk