For all employees authorised to process data: key concepts of Reg. EU 2016/679, behaviour in the office, data breaches and phishing. 15 questions, about 10 minutes. Translated from Italian: legal references remain the Italian ones (D.Lgs. 81/2008) Sources: D.Lgs. 196/2003; Reg. (UE) 2016/679 (GDPR); Garante per la protezione dei dati personali · Reviewed 21/10/2026 · Training support, not a certification.
What is personal data according to art. 4 of the GDPR?
Only health and criminal data
Any information about a company
Only information written on paper
Any information relating to an identified or identifiable natural person
2 / 15 · 30s · 1 pt
Which of these falls within the "special categories" of art. 9 GDPR?
The company email address
The role in the organisation chart
A medical certificate with the diagnosis
The employee number
3 / 15 · 30s · 1 pt
Who is the data controller?
Whoever physically enters the data into the management system
The Italian Data Protection Authority (Garante)
The person the data relates to
Whoever determines the purposes and means of the processing of personal data
4 / 15 · 30s · 1 pt
What role does an external firm that prepares payslips on behalf of the company have?
Data processor, appointed by contract or other legal act
Supervisory authority
Data subject
Independent controller, without any agreement
5 / 15 · 30s · 1 pt
What does the data minimisation principle mean?
As much data as possible is collected, just in case
The number of employees who use the computer is reduced
Data is kept for as long as possible
Only data that is adequate, relevant and limited to what is necessary for the purpose is processed
6 / 15 · 30s · 1 pt
On what legal basis does the employer process an employee's data to pay their salary?
The employee's consent, which can be withdrawn at any time
Protection of the employee's vital interests
Performance of the employment contract and legal obligations
The legitimate interest of the software supplier
7 / 15 · 30s · 1 pt
Within what time must the controller notify the Garante of a personal data breach?
Within 30 days
Within 72 hours of becoming aware of it, if the breach presents a risk to individuals
It never has to be notified
Within a year
8 / 15 · 30s · 1 pt
You mistakenly sent a customer a file with other customers' data. What do you do?
Delete the email from your sent items
Report it immediately to the privacy contact or the DPO according to the company procedure: it is a possible data breach
Say nothing, hoping they will not open the file
Ask the customer to delete it and tell nobody
9 / 15 · 30s · 1 pt
How long do you have to reply to a data subject who exercises their rights (access, rectification, erasure)?
Within a year
Within 72 hours
Within one month, extendable by two months in complex cases
There is no deadline
10 / 15 · 30s · 1 pt
How high can the highest administrative fines under the GDPR go?
1% of net profit
20 million euro or 4% of annual worldwide turnover, whichever is higher
5,000 euro
100,000 euro
11 / 15 · 30s · 1 pt
What is the Italian supervisory authority for personal data protection?
ANAC
INPS
The Italian Data Protection Authority (Garante per la protezione dei dati personali)
AGCOM
12 / 15 · 20s · 1 pt
A colleague's first and last name in a company email is not personal data.
True
False
13 / 15 · 30s · 1 pt
You receive an urgent email from the "IT service" asking you to enter your password via a link. What do you do?
Forward it to colleagues to find out if it is real
Reply to the email asking if it is genuine
Click and enter the password, if the logo looks like the company's
Do not click and report it to IT through official channels
14 / 15 · 45s · 1 pt
Which behaviours protect personal data in the office? (2 answers)
Putting documents with personal data away in locked cabinets at the end of the day
Throwing documents containing personal data into the wastepaper bin without shredding them
Sharing your password with trusted colleagues
Locking the screen when you leave your workstation
15 / 15 · 30s · 1 pt
Employees who process personal data under the controller's authority…
can use the data as they see fit
must register with the Garante
automatically become joint controllers
must be authorised and instructed by the controller
How to use it
Copy the quiz into your free account, edit it if needed and run it live: players join from their phones with a code or a QR code, no app needed. The correct answers are not published here: you see them in your copy.