Certified Information Privacy Professional – Europe (CIPP/E) — Question 249

The European Data Protection Board (EDPB) recommends measures to supplement transfer tools, in order to ensure compliance with the European Union (EU) level of personal data protection. According to these recommendations, what additional actions should be taken when a transfer to a third country is based upon an adequacy decision?

Answer options

• A. Adopt a supplementary data transfer mechanism.
• B. Monitor the ongoing validity of the data transfer mechanism.
• C. Adopt technical, contractual or organizational supplementary measures.
• D. Monitor changes in the law or practice of the third country that would lower the level of protection of personal data.

Correct answer: D

Explanation

The correct answer is D because monitoring changes in the law or practice of the third country is crucial to ensure that the level of personal data protection remains adequate. Options A and C suggest implementing new measures, which are unnecessary if an adequacy decision is in place, and option B focuses on monitoring the transfer mechanism itself rather than the legal environment of the third country.