PDP - Sharing Session ARDP

Based on the Indonesian PDP Law, which of the following is not considered as specific personal data?

• Medical record

• Children data

• Religion

Which of the following fulfills the requirements of explicit consent?

• Consent statement is written inside terms and condition(s)

• Individuals consciously do an action to affirm the consent statement

• A pre-ticked or pre-confirmed consent statement

How long should data breaches be reported?

• 1 x 24 hours

• 2 x 24 hours

• 3 x 24 hours

What should be included in the personal data register?

• Legal basis and purpose of processing of data

• Systems and location where the personal data is processed

• All of the above

Which of the following is not included as Data Subject Rights (DSR)?

• Right to appoint data protection representative

• Right to rectification

• Right to be forgotten

What processing is not considered as high-risk processing?

• Using innovative technology to collect/process personal data

• Process and analyzing name and email data of employees

• Data matching from multiple sources

Which aspects not to be considered for Cross Border Data transfer?

• Adequacy

• Distance

• Subject's Consent

Which of the following is an invalid legal basis?

• Vital interest

• Performance of a contract

• Implicit consent from data subject

Whose consent is not needed to be collected in a special manner under the PDP Law?

• Children

• Senior citizens

• People with disabilities

Based on PDP Law, monitoring and ensuring compliance with PDP Law and the policies of the Personal Data Controller or Personal Data Processor is one of the responsibility of:

• Data Protection Officer

• Risk Management

• Top Management