For all employees authorised to process data: key concepts of Reg. EU 2016/679, behaviour in the office, data breaches and phishing. 15 questions, about 10 minutes. Translated from Italian: legal references remain the Italian ones (D.Lgs. 81/2008) Sources: D.Lgs. 196/2003; Reg. (UE) 2016/679 (GDPR); Garante per la protezione dei dati personali · Reviewed 21/10/2026 · Training support, not a certification.
Frage 1 · Einfachauswahl · 30 s · 1 Pkt.
What is personal data according to art. 4 of the GDPR?
- Only health and criminal data
- Any information about a company
- Only information written on paper
- Any information relating to an identified or identifiable natural person
Frage 2 · Einfachauswahl · 30 s · 1 Pkt.
Which of these falls within the "special categories" of art. 9 GDPR?
- The company email address
- The role in the organisation chart
- A medical certificate with the diagnosis
- The employee number
Frage 3 · Einfachauswahl · 30 s · 1 Pkt.
Who is the data controller?
- Whoever physically enters the data into the management system
- The Italian Data Protection Authority (Garante)
- The person the data relates to
- Whoever determines the purposes and means of the processing of personal data
Frage 4 · Einfachauswahl · 30 s · 1 Pkt.
What role does an external firm that prepares payslips on behalf of the company have?
- Data processor, appointed by contract or other legal act
- Supervisory authority
- Data subject
- Independent controller, without any agreement
Frage 5 · Einfachauswahl · 30 s · 1 Pkt.
What does the data minimisation principle mean?
- As much data as possible is collected, just in case
- The number of employees who use the computer is reduced
- Data is kept for as long as possible
- Only data that is adequate, relevant and limited to what is necessary for the purpose is processed
Frage 6 · Einfachauswahl · 30 s · 1 Pkt.
On what legal basis does the employer process an employee's data to pay their salary?
- The employee's consent, which can be withdrawn at any time
- Protection of the employee's vital interests
- Performance of the employment contract and legal obligations
- The legitimate interest of the software supplier
Frage 7 · Einfachauswahl · 30 s · 1 Pkt.
Within what time must the controller notify the Garante of a personal data breach?
- Within 30 days
- Within 72 hours of becoming aware of it, if the breach presents a risk to individuals
- It never has to be notified
- Within a year
Frage 8 · Einfachauswahl · 30 s · 1 Pkt.
You mistakenly sent a customer a file with other customers' data. What do you do?
- Delete the email from your sent items
- Report it immediately to the privacy contact or the DPO according to the company procedure: it is a possible data breach
- Say nothing, hoping they will not open the file
- Ask the customer to delete it and tell nobody
Frage 9 · Einfachauswahl · 30 s · 1 Pkt.
How long do you have to reply to a data subject who exercises their rights (access, rectification, erasure)?
- Within a year
- Within 72 hours
- Within one month, extendable by two months in complex cases
- There is no deadline
Frage 10 · Einfachauswahl · 30 s · 1 Pkt.
How high can the highest administrative fines under the GDPR go?
- 1% of net profit
- 20 million euro or 4% of annual worldwide turnover, whichever is higher
- 5,000 euro
- 100,000 euro
Frage 11 · Einfachauswahl · 30 s · 1 Pkt.
What is the Italian supervisory authority for personal data protection?
- ANAC
- INPS
- The Italian Data Protection Authority (Garante per la protezione dei dati personali)
- AGCOM
Frage 12 · Wahr / Falsch · 20 s · 1 Pkt.
A colleague's first and last name in a company email is not personal data.
Frage 13 · Einfachauswahl · 30 s · 1 Pkt.
You receive an urgent email from the "IT service" asking you to enter your password via a link. What do you do?
- Forward it to colleagues to find out if it is real
- Reply to the email asking if it is genuine
- Click and enter the password, if the logo looks like the company's
- Do not click and report it to IT through official channels
Frage 14 · Mehrfachauswahl · 45 s · 1 Pkt.
Which behaviours protect personal data in the office? (2 answers)
- Putting documents with personal data away in locked cabinets at the end of the day
- Throwing documents containing personal data into the wastepaper bin without shredding them
- Sharing your password with trusted colleagues
- Locking the screen when you leave your workstation
Frage 15 · Einfachauswahl · 30 s · 1 Pkt.
Employees who process personal data under the controller's authority…
- can use the data as they see fit
- must register with the Garante
- automatically become joint controllers
- must be authorised and instructed by the controller