A. A health authority processing the personal information of its staff in order to record all training undertaken

B. A local authority processing the personal information of the person responsible for paying council tax

C. A debt collection agency processing information relating to unpaid fines for misuse of community council car parking.

D. A tax authority drops cookies on the devices of visitors to its website

A. Limiting the number of records stored in any single repository to minimise risk surface.

B. Only storing data in locations within the EU. except where there is an adequacy decision.

C. Storing data in a secure format only permitting access to those with a business need

D. Keeping identifiable personal data for no longer than is necessary for the intended processing

A. An electronic information service provided to individuals but paid for solely by advertising

B. A service provided for remuneration, by electronic means, at distance to an individual that has requested it.

C. Business to business online networking sites

D. Information services provided by non-profit or government organisations with no remuneration

A. Sign off and record outcomes.

B. Describe the processing

C. Publish any potential risks in your information notice.

D. Identify measures to mitigate the risks

A. Websites only need an opt out of cookies if GDPR applies

B. The GDPR only applies where a cookie processes personal data

C. Where PECR is engaged only PECR will apply to the processing of personal data

D. The GDPR applies in all cases where cookies are used