For all employees authorised to process data: key concepts of Reg. EU 2016/679, behaviour in the office, data breaches and phishing. 15 questions, about 10 minutes. Translated from Italian: legal references remain the Italian ones (D.Lgs. 81/2008) Sources: D.Lgs. 196/2003; Reg. (UE) 2016/679 (GDPR); Garante per la protezione dei dati personali · Reviewed 21/10/2026 · Training support, not a certification.
Question 1 · Single choice · 30s · 1 pt
What is personal data according to art. 4 of the GDPR?
- Only health and criminal data
- Any information about a company
- Only information written on paper
- Any information relating to an identified or identifiable natural person
Question 2 · Single choice · 30s · 1 pt
Which of these falls within the "special categories" of art. 9 GDPR?
- The company email address
- The role in the organisation chart
- A medical certificate with the diagnosis
- The employee number
Question 3 · Single choice · 30s · 1 pt
Who is the data controller?
- Whoever physically enters the data into the management system
- The Italian Data Protection Authority (Garante)
- The person the data relates to
- Whoever determines the purposes and means of the processing of personal data
Question 4 · Single choice · 30s · 1 pt
What role does an external firm that prepares payslips on behalf of the company have?
- Data processor, appointed by contract or other legal act
- Supervisory authority
- Data subject
- Independent controller, without any agreement
Question 5 · Single choice · 30s · 1 pt
What does the data minimisation principle mean?
- As much data as possible is collected, just in case
- The number of employees who use the computer is reduced
- Data is kept for as long as possible
- Only data that is adequate, relevant and limited to what is necessary for the purpose is processed
Question 6 · Single choice · 30s · 1 pt
On what legal basis does the employer process an employee's data to pay their salary?
- The employee's consent, which can be withdrawn at any time
- Protection of the employee's vital interests
- Performance of the employment contract and legal obligations
- The legitimate interest of the software supplier
Question 7 · Single choice · 30s · 1 pt
Within what time must the controller notify the Garante of a personal data breach?
- Within 30 days
- Within 72 hours of becoming aware of it, if the breach presents a risk to individuals
- It never has to be notified
- Within a year
Question 8 · Single choice · 30s · 1 pt
You mistakenly sent a customer a file with other customers' data. What do you do?
- Delete the email from your sent items
- Report it immediately to the privacy contact or the DPO according to the company procedure: it is a possible data breach
- Say nothing, hoping they will not open the file
- Ask the customer to delete it and tell nobody
Question 9 · Single choice · 30s · 1 pt
How long do you have to reply to a data subject who exercises their rights (access, rectification, erasure)?
- Within a year
- Within 72 hours
- Within one month, extendable by two months in complex cases
- There is no deadline
Question 10 · Single choice · 30s · 1 pt
How high can the highest administrative fines under the GDPR go?
- 1% of net profit
- 20 million euro or 4% of annual worldwide turnover, whichever is higher
- 5,000 euro
- 100,000 euro
Question 11 · Single choice · 30s · 1 pt
What is the Italian supervisory authority for personal data protection?
- ANAC
- INPS
- The Italian Data Protection Authority (Garante per la protezione dei dati personali)
- AGCOM
Question 12 · True / False · 20s · 1 pt
A colleague's first and last name in a company email is not personal data.
Question 13 · Single choice · 30s · 1 pt
You receive an urgent email from the "IT service" asking you to enter your password via a link. What do you do?
- Forward it to colleagues to find out if it is real
- Reply to the email asking if it is genuine
- Click and enter the password, if the logo looks like the company's
- Do not click and report it to IT through official channels
Question 14 · Multiple choice · 45s · 1 pt
Which behaviours protect personal data in the office? (2 answers)
- Putting documents with personal data away in locked cabinets at the end of the day
- Throwing documents containing personal data into the wastepaper bin without shredding them
- Sharing your password with trusted colleagues
- Locking the screen when you leave your workstation
Question 15 · Single choice · 30s · 1 pt
Employees who process personal data under the controller's authority…
- can use the data as they see fit
- must register with the Garante
- automatically become joint controllers
- must be authorised and instructed by the controller