IAPP Updated CIPP-E Exam Questions and Answers by dawid

 The GDPR requires that personal data be kept for no longer than is necessary for the purposes for which the personal data are processed1. However, the GDPR also allows member states to provide for more specific rules on the processing of employees’ personal data in the employment context, including the retention periods for erasure and deletion of categories of personal data2. Therefore, the employer should securely store the data that is required to be kept under local law, such as tax records, pension records, or health and safety records34. The employer should also ensure that the data is protected from unauthorized or unlawful access, accidental loss, destruction, or damage1. The employer should not store the data for longer than necessary or for purposes other than those for which the data was collected, unless the employee has given consent or there is another legal basis for doing so13. References: 1: Article 5 of the GDPR 2: Article 88 of the GDPR 3: Data Protection and GDPR in the Workplace | Factsheets | CIPD 4: How to Manage the Retention of Employee Data | GDPR Blog

According to the UK GDPR, a processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller1. A processor must act only on the documented instructions of the controller and must not process the data for its own purposes or in a way that is incompatible with the controller’s purposes1. If a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller, it will be considered to be a controller in respect of that processing and will be subject to the same obligations and liabilities as a controller under the UK GDPR1. This means that the processor will have to comply with the data protection principles, ensure the rights of data subjects, implement appropriate technical and organisational measures, report data breaches, conduct data protection impact assessments, appoint a data protection officer if required, and cooperate with the supervisory authority1. The processor will also be exposed to the risk of administrative fines, compensation claims, and reputational damage1. References: 1

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/

 The GDPR requires that consent must be freely given, specific, informed and unambiguous1. This means that app developers must provide clear and transparent information about the purposes and legal basis of the data processing, and allow users to choose which types of processing they agree to and which they do not. For example, users should be able to consent separately to different types of cookies, such as functional, analytical or marketing cookies2. Users should also be able to withdraw their consent at any time as easily as they gave it1. Therefore, app design and implementation must take into account these requirements and provide users with granular and user-friendly consent options, rather than relying on pre-ticked boxes, implied consent or default settings3. References: 1 Art. 4 (11) and Art. 7 GDPR – Definitions and Conditions for consent - General Data Protection Regulation (GDPR)2 Guidelines 05/2020 on consent under Regulation 2016/679 - European Data Protection Board3 How To Make Compliant GDPR Consent Forms (With Examples) - Termly.