R01 Data protection and security: free practice questions

1. Question 1 of 5

   Which of these could be personal data under UK GDPR?

   Option A: Only information that's held electronically on a systemOption B: Anything that identifies a living person, directly or notOption C: Only a person's name and home addressOption D: Information about companies and other organisations

   Show answer

   The answer is B: Anything that identifies a living person, directly or not

   Personal data is any information identifying a living individual, directly or indirectly, such as an IP address. It covers manual filing systems as well as electronic data. Anonymised data falls outside.

   Why the other options are wrong

   A

   Manual filing systems are covered too.

   C

   Personal data goes much wider than name and address.

   D

   The legislation protects living individuals, not companies.

2. Question 2 of 5

   Which data protection principle requires firms to collect no more personal data than they need?

   Option A: AccuracyOption B: Storage limitationOption C: AccountabilityOption D: Data minimisation

   Show answer

   The answer is D: Data minimisation

   Data minimisation means using the minimum amount of data needed for the purpose. Storage limitation is about how long it's kept.

   Why the other options are wrong

   A

   Accuracy concerns keeping data correct and up to date.

   B

   Storage limitation concerns keeping data no longer than needed.

   C

   Accountability concerns taking responsibility and evidencing compliance.

3. Question 3 of 5

   How quickly should a firm respond to a subject access request?

   Option A: Within one year of receiving the requestOption B: Within one month, plus two more if it's complexOption C: Within five working days of receiving the requestOption D: Within six months of receiving the request

   Show answer

   The answer is B: Within one month, plus two more if it's complex

   A subject access request (verbal or written) should be answered within one month, with up to two more months for complex requests.

   Why the other options are wrong

   A

   One year is too long.

   C

   Five working days isn't the requirement.

   D

   Six months is too long.

4. Question 4 of 5

   A firm loses a laptop containing client files, creating a high risk to those clients. What must it do?

   Option A: Nothing, as long as the laptop was password protectedOption B: Report only to the FCAOption C: Wait to see if the data is misusedOption D: Report the breach to the ICO and alert the affected clients

   Show answer

   The answer is D: Report the breach to the ICO and alert the affected clients

   Breaches likely to pose a risk must be reported to the ICO. Where the risk to individuals is high, the data subjects must also be told.

   Why the other options are wrong

   A

   A breach posing high risk must be reported, whatever the password position.

   B

   Data breaches are reported to the ICO.

   C

   Firms must act, not wait.

5. Question 5 of 5

   Which lawful basis for processing personal data was added by the Data (Use and Access) Act 2025?

   Option A: Necessary commercial interestOption B: Reasonable customer expectationOption C: Implied consent from silenceOption D: Recognised legitimate interest

   Show answer

   The answer is D: Recognised legitimate interest

   The DUAA added recognised legitimate interest, for specified pre-approved purposes such as safeguarding a vulnerable person, responding to an emergency or preventing and detecting crime. Unlike legitimate interests, it needs no balancing test.

   Why the other options are wrong

   A

   There's no 'necessary commercial interest' basis; commercial aims fall under legitimate interests.

   B

   There's no lawful basis called reasonable customer expectation.

   C

   Consent can never be inferred from silence.

R0 Exam Prep is an independent revision tool. It is not produced, endorsed by or affiliated with the Chartered Insurance Institute (CII). Questions and explanations are original. Use it alongside the official study text. About R0 Exam Prep