PECB GDPR - Certified Data Protection Officer

Here you have the best PECB DPO practice exam questions

  • You have 80 total questions across 16 pages (5 per page)
  • These questions were last updated on February 19, 2026
  • This site is not affiliated with or endorsed by PECB.
Question 1 of 80
Scenario 1: MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved, as a response to patients' needs.
Patients that schedule an appointment in MED's medical centers need to initially provide their personal information, including name and surname, address, phone number, and date of birth. Further checkup or admission requires extra information, including previous medical history and genetic data. When providing the personal data, patients are informed that the data is used for personalizing their treatments and improving the communication between them and MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescription, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information, as needed.
Patients who decide to continue the treatment in another health institution can request by MED to transfer their data. Even if patients decide to continue their treatment in other health institutions, their personal data is still used by MED and patients' requests to stop data processing are rejected. This has been decided from MED's top management in order to save the information of everyone who gets registered in their databases. The company shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
MED believes that it is its responsibility to ensure the security and accuracy of the patients' personal data. Thus, based on the identified risks presented by data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each information and processing activity. MED has communicated the policy and other procedures to the personnel and provided customized training to all personnel to ensure that it is able to use MED's systems needed for data processing.
Based on this scenario, answer the following question:
If a patient requests MED to permanently erase their data, MED should:
Answer

Suggested Answer

The suggested answer is B.

Community Votes

No votes yet

Join the discussion to cast yours

Question 2 of 80
Based on scenario 1, is the processing of children's personal data performed by MED in compliance with the GDPR?
Answer

Suggested Answer

The suggested answer is B.

Community Votes

No votes yet

Join the discussion to cast yours

Question 3 of 80
Considering the nature of data processing activities described in scenario 1, is GDPR applicable to MED?
Answer

Suggested Answer

The suggested answer is A.

Community Votes

No votes yet

Join the discussion to cast yours

Question 4 of 80
Based on scenario 1, MED shares their patients' personal data with a health insurance company. Does MED comply with the purpose limitation principle?
Answer

Suggested Answer

The suggested answer is C.

Community Votes

No votes yet

Join the discussion to cast yours

Question 5 of 80
Based on scenario 1, which data subject right is NOT guaranteed by MED?
Answer

Suggested Answer

The suggested answer is B.

Community Votes

No votes yet

Join the discussion to cast yours

About the PECB DPO Certification Exam

About the Exam

The PECB DPO (PECB GDPR - Certified Data Protection Officer) validates your knowledge and skills. Passing demonstrates proficiency and can boost your career prospects in the field.

How to Prepare

Work through all 80 practice questions across 16 pages. Focus on understanding the reasoning behind each answer rather than memorizing responses to be ready for any variation on the real exam.

Why Practice Exams?

Practice exams help you familiarize yourself with the question format, manage your time, and reduce anxiety on the test day. Our DPO questions are regularly updated to reflect the latest exam objectives.