Exam CIPP-E topic 1 question 121 discussion

Article 30 of the GDPR does not specifically require controllers to keep records of personal data breaches

The correct answer is: **B. Data inventory or data mapping exercises that have been conducted.** Explanation: Under **Article 30 of the GDPR**, controllers are required to maintain records of processing activities, which include: - **A.** Records of personal data breaches are not explicitly required under Article 30, but breaches must be reported and documented under **Article 33**. - **C.** Categories of recipients to whom personal data have been disclosed. - **D.** Retention periods for the erasure and deletion of categories of personal data. However, **data inventory or data mapping exercises** are not part of the explicit record-keeping obligations under Article 30, even though these exercises can help an organization understand its data flows and processing activities.

A. Incidents of personal data breaches, whether disclosed or not. Explanation: A. Incidents of personal data breaches, whether disclosed or not: Article 30 of the GDPR does not specifically require controllers to keep records of personal data breaches. However, Article 33 of the GDPR requires controllers to document any personal data breaches, including their effects and remedial actions taken, but this is separate from the record-keeping requirements of Article 30.

**B. Data inventory or data mapping exercises that have been conducted.** Under Article 30 of the GDPR, controllers are required to maintain records of processing activities that include information such as the purposes of processing, categories of data subjects, categories of personal data, categories of recipients, and retention periods. While data inventory or mapping exercises are useful for understanding processing activities, they are not specifically required to be recorded under Article 30.

Not in ROPA

The correct answer is A. Art. 30 is about ROPA, while documenting data breach is in Art. 33 under security of personal data.

Correct answer is A - reporting requirements are addressed in Article 33, not 30 which deals with records of processing

The correct answer is B