A retail company receives a request to remove a customer's data. Which of the following is the retail company considered under GDPR legislation?

The correct answer is B. Data controller. Under GDPR, the data controller determines the purposes and means of processing personal data. The retail company, which collects and manages customer data, is responsible for complying with data deletion requests and thus acts as the data controller.

Submitted by carlos_mx· Mar 6, 2026Security program management and oversight

Question

Options

AData processor
BData controller
CData subject
DData custodian

How the community answered

(49 responses)

A
2% (1)
B
94% (46)
D
4% (2)

Explanation

Under GDPR, the data controller determines the purposes and means of processing personal data. The retail company, which collects and manages customer data, is responsible for complying with data deletion requests and thus acts as the data controller.

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice