6 matched pairs · aligned to the six course objectives · multiple choice · answer key below
Each row tests one objective twice. The pre and post items are parallel forms. They ask the same thing in different words so a higher post score reflects learning, not a memorized question.
| Objective | Pre-test item | Post-test item (parallel) |
|---|
| Define personal data | Which of these on its own counts as personal data? (A) office floor number (B) work email address (C) company revenue (D) product SKU | A record includes a home postcode and nothing else. Is it personal data, and why? |
| Lawful basis for processing | Before using customer data for a new purpose, what must you establish first? | Marketing wants to reuse sign-up data for ads. What has to be in place before they can? |
| Data minimization | Which practice best reflects data minimization? | A form asks for date of birth to confirm a discount is adult-only. What change fits minimization? |
| Handling a subject request | A customer asks for a copy of their data. What is the first step? | An employee emails asking you to delete their data. How do you begin, and by when? |
| Recognizing a breach | Which event most clearly counts as a personal-data breach? | A laptop with an unencrypted client list is stolen. Is this reportable, and to whom first? |
| Third-party sharing | Before sharing data with a vendor, what document governs their use of it? | A new analytics vendor will process user data. What must be signed before data flows to them? |
Answer key with rationales:
- Personal data. Pre: B, a work email identifies a person. Post: yes, a full postcode can single out a household, so it's personal data.
- Lawful basis. Both: identify and document a lawful basis for the new purpose before processing.
- Minimization. Both: collect only what the stated purpose needs; drop full date of birth in favor of a simple age-check.
- Subject request. Both: verify the requester's identity, then log the request and meet the one-month response window.
- Breach. Both: yes, an unencrypted client list exposed is reportable; notify your data protection lead first.
- Third-party sharing. Both: a data processing agreement must be in place before any data is shared.
Give the pre-test at kickoff and the post-test at close. Compare the two scores per objective. The objectives with the smallest lift tell you where the course needs another pass.
