Certified Information Privacy Professional – Europe (CIPP/E) — Question 87

Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?

Answer options

• A. Only where the personal data is produced as a physical output of specific automated processing activities, such as printing, labelling, or stamping.
• B. Only where the personal data is to be subjected to specific computerized processing, such as image scanning or optical character recognition.
• C. Only where the personal data is treated by automated means in some way, such as computerized distribution or filing.
• D. Only where the personal data is handled in a sufficiently structured manner so as to form part of a filing system.

Correct answer: D

Explanation

The correct answer is D because the GDPR applies to personal data that is organized in a structured manner, making it part of a filing system, regardless of whether it is in physical or digital form. The other options focus on specific automated processing methods which do not necessarily encompass all scenarios where GDPR would apply to physical data.