EXIN Privacy and Data Protection Foundation - PDPF Exam Questions [2026]

QUESTION NO: 1
What is the main purpose of cookies?

A. Display advertisements directed to the user, using information collected from the browser. B. Infect computers so that unsolicited advertisements are displayed in the browser. C. Identify user preferences, identify the user and it can also save login to a website. D. Save the browser history, making it easier for the user to access the page again in the future.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
According to the GDPR, what is a mandatory topic in a DPIA report?

A. The documentation of the risks to the rights and freedoms of the data protection officer B. An assessment of the necessity and proportionality of the processing operations in relation to the purposes C. Systematic description of the fiduciary duties to ensure compliance to all relevant laws and regulations D. The measures envisaged to address the privacy compliance frameworks risks

Correct Answer: B

QUESTION NO: 3
The General Data Protection Regulation (GDPR) came into effect on May 25, 2018, what is the legal status of this regulation?

A. Some articles in the GDPR provide guidance and allow Member States to draft more specific laws to suit. B. The GDPR is only a recommendation. Member States should create laws to suit C. The GDPR is a functional law in all EU member states and Member States cannot rectify it.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
According to the GDPR, in what situation must data subjects always be notified of a personal data breach?

A. When the system on which the personal data is processed is attacked causing damage to its storage devices B. When there is a significant probability that the breach will lead to a high risk for the privacy of the data subjects C. When personal data is processed at a facility of the processor that is not located within the borders of the EEA D. When personal data is processed by a party that agreed to the draft processing contract but has not yet signed it

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
What is the main difference between Directive 95/46 / EC and the General Data Protection Regulation (GDPR)?

A. Directive 95/46 / EC offers guidance for EU Member States and can create their own laws to suit the directive. The GDPR has the force of law and all EU Member States must follow it without changing it. B. The GDPR offers guidance for EU Member States and can create their own laws to comply with the regulation. Directive 95/46 / EC has the force of law and all EU Member States must follow it without changing.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Article 33 of the GDPR deals with "Notification of a personal data breach to the supervisory authority".
Paragraph 3 sets out the minimum information that must be included in this notification. Which of the below is one of these?

A. Contact information for all data subjects. B. The contact of the data protection officer or another point of contact where more information could be obtained. C. A copy of the breached personal data to be analyzed.
Section: (none)
Explanation

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
When is a Data Protection Impact Assessment (DPIA) under the General Data Protection Regulation (GDPR) mandatory?

A. Application of new technologies that may imply a high risk to the rights and freedoms of data subjects. B. There is no security policy and information security risk analysis. C. In all types of personal data processing.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).