Certified Information Privacy Professional – Europe (CIPP/E) — Question 242

According to Art. 23 GDPR, which of the following data subject rights can NOT be restricted?

Answer options

• A. Right to restriction of processing.
• B. Right to erasure ("Right to be forgotten").
• C. Right to lodge a complaint with a supervisory authority.
• D. Right not to be subject to automated individual decision-making.

Correct answer: C

Explanation

The correct answer is C because the right to lodge a complaint with a supervisory authority is fundamental and cannot be restricted under GDPR. The other rights, such as the right to restriction of processing, right to erasure, and right not to be subject to automated individual decision-making, can be limited under certain circumstances as provided by the regulation.