Certified Information Privacy Professional – Europe (CIPP/E) — Question 217

Which aspect of processing does the GDPR allow processors to determine for themselves?

Answer options

• A. The question of whether the controller needs to be informed about the substitution of another processor carrying out specific processing activities on behalf of the controller.
• B. Their own purposes for the processing, if such purposes are compatible with those for which the personal data were initially collected.
• C. The parameters of their marketing campaigns using personal data relating to the controller's customers.
• D. Their own type of hardware or software and the specific security measures for the processing.

Correct answer: D

Explanation

The correct answer is D because the GDPR allows processors the autonomy to select their own hardware or software and define the security measures for processing. Options A, B, and C relate to the responsibilities and objectives of the data controller, rather than the processor's independent decisions.