PDPF Privacy and Data Protection Foundation Exam Topics and Questions

The exam opens here because everything else depends on it. Before you can reason about rights, breaches, or transfers, you need a precise working definition of what the GDPR actually covers. This topic tests whether you can draw the boundary correctly: what counts as personal data, what counts as processing, and where EU law reaches. Get these definitions wrong and you will misread scenario questions throughout the rest of the exam.

– Privacy, personal data, and the legal backdrop

The relationship between privacy as a concept and data protection as a legal mechanism is the first thing to get straight. Privacy is the underlying right; data protection is the regulatory instrument that gives it teeth in EU law. The GDPR sits within a layered framework: EU-level regulation sets the floor, and Member State law fills in certain gaps or adds restrictions on top. You need to know that this layering exists and why it matters, because exam scenarios sometimes hinge on whether a national rule can validly narrow or extend a GDPR provision. The practical question is always: does EU law govern here, and if so, at which level?

– Defining personal data and processing

The GDPR's definition of personal data is broader than most candidates expect. Any information that can identify a living natural person, directly or indirectly, falls inside it. The exam probes the word 'indirectly': a reference number or an IP address can be personal data if someone could use it to single out an individual. Special categories are a subset with a higher protection threshold, covering health, biometric, racial, and similar data. The distinction between ordinary personal data and special categories changes which lawful basis applies and which safeguards are required. Processing is defined just as broadly: collection, storage, alteration, disclosure, erasure, and anything in between all count. Knowing where processing begins and ends, and which activities fall inside the GDPR's territorial and material scope, is the foundation the rest of the syllabus builds on.

How GDPR scope is tested

At 12% of the exam, this topic delivers a meaningful share of questions but is not the dominant one. Items here are typically scenario-based: you are given a description of a data set or an activity and asked to classify it. The trap is over-confidence with familiar examples. Candidates who have a rough sense of what personal data means often miss edge cases where indirect identification is possible, or where data that looks anonymous is not. Special categories catch people who know the list but cannot apply it when the scenario disguises the data type. Items on EU and Member State law reward candidates who understand that the GDPR is a regulation with direct effect, not a directive requiring transposition, and that Member State derogations are limited and specific. Read every scenario carefully for the detail that shifts the classification. The broadest, most legally accurate interpretation of 'personal data' and 'processing' is almost always what items reward.

With scope established, the exam shifts to what organisations must actually do once they are inside the GDPR's reach. At 38%, this topic is where the exam is won or lost. The breadth is real: stakeholder roles, the seven principles, six lawful bases, and eight data-subject rights all live here. Candidates who treat this as a memorisation exercise rather than an application one tend to struggle, because items almost always present a situation and ask what should happen, not what the rule says.

– Roles, responsibilities, and administration

The GDPR assigns specific legal obligations depending on whether an entity is a controller, a processor, or a joint controller. The distinction matters in exam scenarios because it determines who is accountable for a given decision and what documentation is required. Article 28 governs the contractual relationship between controller and processor, and Article 30 requires both to maintain records of processing activities. Items in this area often describe an organisational arrangement and ask you to assign the correct role. The trap is assuming that a company handling data on someone else's behalf is automatically a processor: if it determines the purpose or means of processing, it is a controller regardless of the commercial relationship.

– Lawful basis and data protection by design

There are exactly six lawful grounds for processing, and knowing all six is necessary but not sufficient. The exam tests whether you can identify which ground applies in a given scenario and whether the conditions for that ground are met. Consent, for instance, has specific requirements around being freely given, specific, informed, and unambiguous; failing any one of those conditions means it does not qualify. Legitimate interest requires a balancing test. The seven principles of data protection by design are a separate but related area: they set out how privacy should be built into systems from the start rather than added afterwards. Items here reward candidates who understand the practical difference between privacy by design and privacy by default, and why both are required.

– Data-subject rights

Eight rights are examinable: access, rectification, erasure, restriction of processing, data portability, objection, rights related to automated decision-making, and the right to transparent information. Each right has conditions, exceptions, and time limits attached. The exam does not simply ask you to list them; it presents a situation where a data subject makes a request and asks what the controller must do, or whether the right applies at all. Portability, for example, only applies to processing carried out by automated means on the basis of consent or contract. Erasure has exceptions that candidates routinely overlook. Automated decision-making rights apply specifically where a decision produces legal or similarly significant effects. Know the boundaries, not just the names.

– Processing principles

The six principles in Article 5 underpin every other rule in this topic. Lawfulness, fairness, and transparency form the first principle and connect directly to the lawful basis section. Purpose limitation means data collected for one reason cannot be freely reused for another. Data minimisation and storage limitation together constrain how much data is held and for how long. Accuracy, integrity, and confidentiality address data quality and security. Proportionality and subsidiarity are not named explicitly in Article 5 but appear in the syllabus because they inform how the principles are applied in practice. Items on these principles tend to describe a processing activity and ask which principle is being violated, or what a compliant approach would look like. The strongest responses identify the specific principle and explain why the scenario breaches it.

How Principles of data processing is tested

At 38%, this topic accounts for more than a third of the exam. Expect a high volume of scenario-based items rather than recall questions. The examiners test whether you can apply rules to situations, not whether you can reproduce them. A common pattern is a scenario where an organisation is doing something that looks reasonable but violates a specific principle or exceeds the scope of a lawful basis. Items reward candidates who can identify the precise rule being breached, not just sense that something is wrong. Rights questions are particularly demanding because each right has carve-outs: knowing when erasure does not apply, or when portability is unavailable, is what separates a passing answer from a failing one. Time pressure is a factor here: because the topic is large, candidates who have not practised applying these rules under time constraints often run out of space. Roles and administration items tend to be more straightforward, but they require accurate recall of which article governs which obligation.

After the broad sweep of principles, this topic narrows to three specific operational contexts: managing data across its lifecycle, processing in online environments, and using AI. At 10%, it is the lightest weighted topic on the exam, but the questions it generates are applied and practical. Candidates who have absorbed the principles well will find this topic reinforces them; those who have not will find it exposes the gaps.

– Data lifecycle and online processing

Data lifecycle management provides a framework for thinking about personal data from collection through to deletion. The exam does not test the mechanics of DLM in depth, but it does expect you to understand that each stage of the lifecycle carries GDPR obligations, and that storage limitation and purpose limitation are particularly relevant as data ages. Online processing introduces cookies as a specific mechanism. You need to know what a cookie is technically, what it does, and why it triggers data protection obligations when it processes personal data. The right to object to direct marketing, including profiling, is a firm right with no balancing test: the controller must stop when an objection is made. That absolute character is the detail candidates most often miss.

– AI and GDPR compliance

AI creates GDPR compliance challenges that do not arise with conventional processing. The exam focuses on two: identifying where AI-driven processing creates compliance risks, and describing what conditions must be met for AI use to be lawful. The challenges include opacity in automated decision-making, the difficulty of demonstrating purpose limitation when a model is trained on broad data sets, and the risk that outputs constitute special-category data even when inputs do not. Compliance conditions connect back to the principles topic: a lawful basis is still required, data minimisation still applies, and where AI produces decisions with significant effects on individuals, the rights around automated decision-making are engaged. Items here reward candidates who can map a described AI use case to the relevant GDPR obligations rather than treating AI as a special category that sits outside normal rules.

How Practice of data processing is tested

At 10%, this topic generates a small number of items, but they tend to be more scenario-specific than the principle-level questions in topic two. Expect to be given a concrete situation, such as a company deploying a cookie-based tracking system or using a machine-learning model for customer decisions, and asked to identify the compliance issue or the correct course of action. The AI sub-topic is the area where candidates most often lose marks, partly because it is newer and partly because the temptation is to treat AI as entirely novel when the exam rewards applying established GDPR principles to the AI context. Cookie questions are generally more predictable, but the right to object to direct marketing catches candidates who assume the controller can balance competing interests: no such balance is available here. Items reward precision about which obligation applies and why.

Moving data across borders is where the GDPR's territorial logic becomes concrete. The rules differ depending on whether the destination is inside or outside the European Economic Area, and they differ again depending on the specific country. At 15%, this topic is more substantial than its surface simplicity suggests. Candidates underestimate it because the rules feel procedural; the exam tests whether you can apply them to transfer scenarios where the facts determine which mechanism is available.

– Transfers within the EEA and binding corporate rules

Data flows between EEA member states are generally free because the GDPR applies uniformly across the area. The exam is less interested in the free-flow principle itself than in the mechanism organisations use to formalise transfers within a corporate group: binding corporate rules. BCRs are approved codes of conduct that allow multinational groups to transfer data internally without relying on individual transfer mechanisms for each flow. The exam tests the structure of BCRs: what they must contain, how they formalise the relationship between a controller and its processors within the group, and what the approval process involves. Items here often present a corporate structure and ask whether BCRs are available or appropriate, or what a BCR must include to satisfy a supervisory authority.

– Transfers outside the EEA

Transfers to third countries require a legal mechanism. The exam covers the general framework for third-country transfers and gives particular attention to transfers between the EEA and the United States. The US relationship has a specific regulatory history, and the exam expects you to know the current framework governing those flows. Items in this area often describe a transfer scenario and ask which mechanism applies or whether the transfer is lawful as described. The trap is applying a mechanism that exists but is not available in the specific scenario, for instance treating a country as adequate when it has no adequacy decision. Knowing which mechanisms exist, what their conditions are, and when each one can be used is more important than knowing the historical sequence of frameworks.

How International personal data transfers is tested

At 15%, this topic generates a meaningful share of questions and the scenarios tend to be specific. You will be given a transfer situation: a company sending customer data to a service provider in a named country, or a group moving HR records across its global entities. The item then asks whether the transfer is lawful, which mechanism applies, or what is missing from the described arrangement. Items reward candidates who know the hierarchy: free flow inside the EEA, adequacy decisions for third countries, and then specific mechanisms like BCRs or standard contractual clauses where no adequacy decision exists. The EEA-to-US framework is a recurring area of focus, and candidates who know only the historical frameworks rather than the current one lose marks. BCR questions catch candidates who confuse the controller-to-processor relationship formalised in a BCR with the general Article 28 processor agreement. Precision about which document does which job is what items reward here.

The final topic shifts from what the rules are to what happens when things go wrong, or might go wrong. At 25%, it carries real weight. DPIAs, breach management, and supervisory authority enforcement are all here. These areas reward candidates who understand process and sequence: not just what each mechanism is, but when it is triggered, who is involved, and what happens if the steps are skipped or done out of order.

– Data protection impact assessments

A DPIA is required before processing that is likely to result in a high risk to individuals. The exam tests when a DPIA is mandatory, what it must cover, and what the eight objectives of the process are. It also tests the contents of a DPIA report. The prior consultation obligation is linked: where a DPIA concludes that a high risk cannot be mitigated, the controller must consult the supervisory authority before proceeding. Candidates lose marks by treating the DPIA as a general good-practice exercise rather than a legally triggered obligation with defined outputs. Items reward candidates who can identify the threshold for mandatory DPIA and describe what a completed DPIA report must include, not just what purpose the exercise serves.

– Personal data breaches

The GDPR distinguishes a security incident from a personal data breach. An incident becomes a breach when it results in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. That distinction is examinable: not every security event triggers GDPR breach obligations. Once a breach is confirmed, notification obligations apply on a strict timeline. The exam tests who must be notified, under what conditions, and by when. Controllers notify the supervisory authority; they notify data subjects when the breach is likely to result in a high risk to those individuals. Processors notify the controller. Items here often present a breach scenario and ask whether notification is required, who receives it, and what it must contain. The conditions for exemption from data-subject notification are a specific trap.

– Supervisory authorities and enforcement

Supervisory authorities are the national bodies responsible for monitoring GDPR compliance and enforcing it. The exam tests their general responsibilities and their enforcement powers, with particular focus on administrative fines. There are two tiers of fines with different ceilings, and the tier that applies depends on which provision was violated. Items in this area tend to be more straightforward than breach or DPIA questions, but they reward accurate knowledge of what supervisory authorities can and cannot do, and what factors influence the level of a fine. Candidates who know only that fines exist, without knowing the conditions under which each tier applies, will lose marks on enforcement questions.

How Risk assessment and mitigation is tested

At 25%, this topic is the second largest on the exam and its items are among the most process-dependent. DPIA questions reward candidates who know the trigger conditions and the required outputs, not just the concept. Breach questions are the area where sequencing matters most: items test whether the right stakeholders are notified in the right order within the right timeframe. The processor-to-controller and controller-to-supervisory-authority notification chain is a recurring test point, and candidates who conflate the two obligations lose marks. Supervisory authority questions are generally more recall-oriented but require precision about which tier of fine applies to which category of violation. Across all three sub-areas, the exam favours candidates who know the conditions and exceptions over those who know the general principle. A scenario may describe a breach that does not require data-subject notification, or a processing activity that does not require a DPIA, and items reward identifying those exemptions accurately.