Exam CIPP-E topic 1 question 115 discussion

The correct answer is: **B. Non-compliant, because the storage of the data exceeds the tasks contractually authorized by the controller.** ### Explanation: In GDPR, controllers determine the purposes and means of processing personal data, while processors act only on the instructions of the controller. If a processor (or even a controller) is found storing data beyond what is authorized by the controller (e.g., beyond what is necessary for the agreed-upon tasks), this constitutes non-compliance. - **A** is incorrect because password protection alone does not address compliance with the GDPR's other principles, such as purpose limitation and data minimization. - **C** is incorrect because password protection does not negate the risk of identifying data subjects, especially if the data includes identifiable information (like social network followers). - **D** is incorrect because simply deleting the data afterward does not make the original storage compliant with the GDPR. The storage must have been authorized and limited to the necessary duration from the beginning.

A, we have no information about the instructions from the controller so it cannot be B.

There is no information about the authorization/purpose and means of the controller, so we do not know if this password protected database is part of the instruction of the controller or not. For all we know this is part of the instruction of controller. To assume that it is not, is guessing. Therefore A is the best answer.

It's A

Relevant Legislation: GDPR Article 28(3): Specifies that a processor must process personal data only on documented instructions from the controller. GDPR Article 5(1)(e): Refers to the storage limitation principle, which requires personal data to be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Therefore, the correct answer is B. Non-compliant, because the storage of the data exceeds the tasks contractually authorized by the controller.