Certified Information Privacy Professional – Europe (CIPP/E) — Question 193

Which of the following is NOT an explicit right granted to data subjects under the GDPR?

Answer options

• A. The right to request access to the personal data a controller holds about them.
• B. The right to request the deletion of data a controller holds about them.
• C. The right to opt-out of the sale of their personal data to third parties.
• D. The right to request restriction of processing of personal data, under certain scenarios.

Correct answer: C

Explanation

The correct answer is C because the GDPR does not include an explicit right for individuals to opt-out of the sale of their personal data, as this is more relevant to laws like the CCPA. Options A, B, and D represent rights explicitly recognized under the GDPR, allowing individuals to access, delete, and restrict their personal data respectively.