A 10-question quiz to check that your teams understand the fundamentals of personal data protection. Adapt it with your internal procedures (contact point, deadlines, tools).
Which of the following can be a lawful basis for processing personal data?
The person's consent
The fact that the data is technically available
The marketing team wanting more data
Performance of a contract with the person
Question 3 · Single choice
A customer asks what personal data your company holds about them. Which right are they exercising?
The right to delisting
The right of access
The right to object
The right to rectification
Question 4 · Single choice
Within what time frame must an organisation, as a general rule, respond to a request to exercise data protection rights?
Within one month at the latest
Within 24 hours of receiving the request
There is no legal time limit to comply with
Within one year at the latest
Question 5 · Single choice
You realise a file containing customer data was sent by mistake to an external recipient. What do you do?
I delete the sent message from my mailbox and tell nobody else in the company
I wait to see whether the external recipient notices the mistake before acting
I wait until the end of the month to mention it in my usual monthly activity report
I immediately inform the person or team in my company in charge of such incidents
Question 6 · Single choice
When a data breach is likely to put individuals at risk, within what time frame should the organisation, where feasible, notify the supervisory authority after becoming aware of it?
72 hours at the latest
12 months at the latest
30 days at the latest
It is never required to notify
Question 7 · Single choice
You are building a newsletter sign-up form. What data should you ask for?
Health data, just in case, to get to know each subscriber much better
As much as possible, with every single field made mandatory for subscribers
Only what is needed to send the newsletter, for example the email address
Anything that might be useful one day, to build up a rich contact database
Question 8 · Single choice
How long can personal data be kept?
Indefinitely, since storage costs almost nothing these days for a company of any size
No longer than necessary for the purpose, according to a period defined in advance
Until the available storage space on the company servers is completely full
Always exactly 10 years, whatever the purpose of the processing concerned
Question 9 · Single choice
Your company entrusts a service provider (processor) with processing personal data on its behalf. What must be in place?
A simple verbal agreement made at a meeting between the two parties is enough
A simple welcome email sent to the provider after the quote has been signed
Nothing in particular: responsibility lies entirely with the provider you have chosen
A contract or other legal act governing the processing and each party's obligations
Question 10 · Multiple choice
Which of these are appropriate good practices for an employee?
Leave a customer file open on screen in a public place
Send customer lists to a personal mailbox to work over the weekend
Lock the workstation when stepping away
Share personal data only with people who need it to do their job
How it works
Create your free account, the template is added to your quizzes, then adapt the questions and send it to your participants.
