Under Article 70 of GDPR, the EDPB is responsible for ensuring consistency in GDPR application and

advising the European Commission on data protection matters.

Option B is correct because the EDPB provides opinions and guidelines on GDPR implementation.

Option A is incorrect because supervision and enforcement are the responsibility of national

supervisory authorities, not the EDPB.

Option C is incorrect because EU laws are adopted by the European Parliament and Council, not the

EDPB.

Option D is incorrect because the EDPB does not conduct audits; national data protection authorities

do.

Reference:

GDPR Article 70(1)(b) (EDPB’s advisory role)

Recital 139 (EDPB ensures consistency in GDPR application)

Under Article 34(3)(a) of GDPR, if personal data is encrypted or otherwise protected, notification to

data subjects is not required unless the risk is high.

Option C is correct because encryption renders the data unintelligible to unauthorized parties,

reducing risk.

Option A is incorrect because not all breaches require data subject notification—only those posing

high risks.

Option B is incorrect because the number of affected individuals does not determine notification

requirements.

Option D is incorrect because notification is based on risk assessment, not supervisory authority

requests alone.

Reference:

GDPR Article 34(3)(a) (No notification required if encryption makes data inaccessible)

Recital 86 (Notification is necessary only if data loss poses a significant risk)

Under Article 32 of GDPR, risk assessments should be based on threats, vulnerabilities, and potential

impact on data subjects. Organizations must identify and mitigate risks to personal data security.

Option A is correct because risk identification should consider threats, vulnerabilities, and impact.

Option B is incorrect because risk can be assessed qualitatively or quantitatively, depending on the

approach used.

Option C is incorrect because DPOs do not define an organization’s risk-based approach.

Option D is incorrect because risk assessment is mandatory under GDPR, not only when a

supervisory authority requests it.

Reference:

GDPR Article 32(1) (Risk-based approach to security)

Recital 83 (Risk assessment in data protection)

Under Article 11(1) of GDPR, controllers are not required to process additional data for the sole

purpose of identifying data subjects if such identification is not needed for processing.

Option C is correct because Pinky does not store identifiable purchase data, so it is not required to

create additional records.

Option A and B are incorrect because GDPR does not obligate controllers to process additional data if

identification is unnecessary.

Option D is incorrect because Pinky cannot require additional information when it does not have a

basis to process identity-linked data.

Reference:

GDPR Article 11(1) (Controllers are not required to process extra data for identification)

Recital 57 (Data controllers should avoid collecting unnecessary identity data)

Under Article 39(1)(b) of GDPR, the DPO is responsible for monitoring compliance, including

ensuring corrective actions are taken to prevent future breaches.

Option A is correct because DPOs must assess whether corrective actions were taken.

Option B is incorrect because the DPO does not execute the breach response plan but advises on

compliance.

Option C is incorrect because documenting and reporting breaches is the responsibility of the

controller, not solely the DPO.

Option D is incorrect because DPOs do not handle compensations—this is a legal issue determined

by courts.

Reference:

GDPR Article 39(1)(b) (DPO’s role in monitoring compliance)

Recital 97 (DPO’s advisory responsibilities)