Organizations are obliged to keep a number of records to demonstrate compliance with the GDPR. Which record is not obligatory according to the GDPR?

Question

Options

• AA record of notifications sent to the supervisory authority regarding processing of personal data
• BA record of all intended processing together with the processing purpose(s) and legal justifications
• CA record of processors including personal data provided and the period this data can be retained
• DA record of data breaches with all relevant characteristics, including notifications

• A
  85% (45)
• B
  6% (3)
• C
  2% (1)
• D
  8% (4)

Explanation

A record of all intended processing together with the processing purpose(s) and legal justifications. Incorrect. A record of all intended processing with the purpose(s) and legal justifications must be A record of data breaches with all relevant characteristics, including notifications. Incorrect. A record of data breaches must be kept. A record of notifications sent to the supervisory authority regarding processing of personal data. Correct. Prior consultation of high-risk processing is obligatory, but there is no need for a separate record of notifications sent. (Literature: A, Chapter 6;GDPR Article 36(1)) A record of processors including personal data provided and the period this data can be retained. Incorrect. A record of processors and data provided must be kept.

No community discussion yet for this question.