先試後買

A. Keeping identifiable personal data for no longer than is necessary for the intended processing

B. Limiting the number of records stored in any single repository to minimise risk surface.

C. Storing data in a secure format only permitting access to those with a business need

D. Only storing data in locations within the EU. except where there is an adequacy decision.

A. Education data, examination scripts and marks

B. Social Work Data.

C. Credit checking agency data

D. Health data

A. The processor shall consult the supervisory authority prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the processor to mitigate the risk.

B. The processor shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.

C. Each processor and, where applicable, the processors representative shall maintain a record of all categories of processing activities earned out on behalf of a controller.

D. A processor shall not process those data except on instructions from the controller, unless required to do so by domestic law

A. To consult the controller prior to appointing any processor.

B. To follow the instructions of the controller in processing personal data

C. To provide the controller with corporate information relating to its board members.

D. To inform the controller of any intended changes of other processors so they can object

A. It fulfils a requirement that data protection is carried out by design and default.

B. It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated

C. It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO

D. It is key to the accountability element of the GDPR.