Quiz template · Corporate

GDPR basics quiz

Twelve questions on the GDPR: the 2018 start date, the 72 hour breach rule, the top fines, who counts as a controller and the rights people have.

Medium
12 questions
30 s each · about 10 min
Checked against 10 sources

Use this template Preview the questions

Most people in your company have signed a GDPR policy. Fewer can say what is in it. This round covers the parts that come up in real work: when the law took effect, how fast a breach must be reported, what the fines can reach and who counts as a controller. The second half is about the rights people have over their data, from access to erasure to portability. Each answer is checked against the text of the Regulation on gdpr-info.eu or the Wikipedia article. Use it before a privacy training to find the gaps, or after one to see what stuck.

How to run it

Run it at the start of a data protection training. The scores show you which articles the group needs most, so you can skip the rest.
Question 4 is the fines question. Pause here and ask the room what a breach would cost your own company. The number wakes people up.
Questions 8 to 10 are the individual rights. After the quiz, show who in your company handles these requests and where they land.

Questions and answers

1What does GDPR stand for?
- AGeneral Data Protection Regulation
- BGlobal Data Privacy Rules
- CGeneral Digital Privacy Regulation
- DGovernment Data Protection Register
Reveal answer
A. General Data Protection Regulation
GDPR is the General Data Protection Regulation, EU Regulation 2016/679. It applies across the EU and the European Economic Area.
2On which date did the GDPR start to apply across the EU?
- A1 January 2016
- B25 May 2016
- C25 May 2018
- D1 January 2020
Reveal answer
C. 25 May 2018
The EU adopted the Regulation on 14 April 2016. Companies then had two years to prepare before it applied on 25 May 2018.
3Under the GDPR, how soon must a controller report a personal data breach to the supervisory authority, where feasible?
- AWithin 24 hours
- BWithin 7 days
- CWithin 30 days
- DWithin 72 hours
Reveal answer
D. Within 72 hours
Article 33 says without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Breaches unlikely to pose a risk are the exception.
4What is the top administrative fine for the most serious GDPR infringements?
- AUp to 1 million euros
- BUp to 20 million euros or 4% of worldwide annual turnover, whichever is higher
- CUp to 10 million euros or 2% of turnover, whichever is lower
- DUp to 5% of annual profit
Reveal answer
B. Up to 20 million euros or 4% of worldwide annual turnover, whichever is higher
Article 83 sets the top tier at 20 million euros or 4 percent of total worldwide annual turnover, whichever is higher. The lower tier is 10 million or 2 percent.
5The right to erasure in Article 17 is also known by what name?
- AThe right to object
- BThe right to rectification
- CThe right to restrict processing
- DThe right to be forgotten
Reveal answer
D. The right to be forgotten
Article 17 is titled Right to erasure, with 'right to be forgotten' in brackets. People can ask for their data to be deleted in set cases.
6Under the GDPR, who decides the purposes and means of processing personal data?
- AThe controller
- BThe processor
- CThe data subject
- DThe supervisory authority
Reveal answer
A. The controller
Article 4 defines the controller as the body that, alone or jointly with others, determines the purposes and means of processing. A processor works on the controller's behalf.
7What does DPO stand for in the GDPR?
- ADigital Privacy Operator
- BData Protection Officer
- CData Processing Overseer
- DData Portability Order
Reveal answer
B. Data Protection Officer
Article 37 covers the data protection officer. Public authorities, and bodies whose core work involves large scale monitoring or special category data, must appoint one.