Data Protection Test

Welcome to your e-assessment.

Number of Questions: 25

Time Allowed: 15 minutes.

You are allowed only one (1) attempt.

By clicking Start, you have consented to your personal information being processed in line with DataPro’s Privacy Policy.

Name

Organisation

A core objective of the NDPA is to:

Restrict access to government information

Encourage unrestricted sharing of personal data

Safeguard the rights of individuals regarding their personal data

Promote economic growth through data collection

None

Technical measures are sometimes thought of as the protection of personal data held in ______________________

computers and networks

our head

office cabinet

phones and flash drives

None

Some of the rights of data subjects include the following except

Arrest and prosecution

Data portability

Restriction of processing

Objection to Automated decision-making and Profiling

None

Which of the following is not a control of compliance?

Direction

Detection

Circulation

Correction

None

When confronting threats from spam emails, an effective measure is----------

c. None of the above

c. Access to data backups (onsite/offsite)

a. To implement an email security and filtering system

d. A and B

None

Which of the following is NOT a key principle of data processing under the NDPA?

Data minimization: collecting only the data necessary for a specific purpose.

Data maximization: collecting as much data as possible for future uses

Purpose limitation: ensuring data is used only for the reason it was collected.

Transparency: informing individuals about how their data is used.

None

Which of the following is not considered a data subject?

Consumers

Vendors

Customers

Job seekers

None

Some common threats when creating a threat list includes the following except

Records of physical assets

Data backups

Computer & network passwords

Cabinet check

None

The storage that comes in different forms including backing up information on removable hard drives or other external storage mediums is referred to as?

Offsite storage

None of the above

Input storage

Onsite storage

None

Personal data must be _______, ______ and ______ to what is necessary in relation to the purposes for which they are processed

detailed, relevant, limited

Transparent, adequate, relevant

adequate, relevant, limited

adequate, relevant, complete

None

The Nigeria Data Protection Commission can:

Force individuals to give up their data rights

Grant exemptions from the NDPA to any company upon request

Investigate complaints of data breaches and enforce compliance with the NDPA

Automatically share personal data with law enforcement agencies without due process

None

The NDPA introduces obligations for data controllers in relation to data retention. Organizations must:

Retain all personal data indefinitely, even if it is no longer necessary.

Establish clear data retention schedules based on legitimate business needs and legal requirements.

Delete all personal data immediately upon a data subject's request

Obtain annual consent from data subjects for continued data retention

None

Technical measures may sometimes be referred as?

Physical Security

Data Security

Cybersecurity

System security

None

Which of the following is not a component of compliance?

Programs

Policies

Measures

Procedures

None

Acting in line with the LETTER and the SPIRIT of laid down rules, regulations, guidelines, standards, laws and codes, conventions; either internal or external is referred to as ______

Compliance

Audit

Control

Policy

None

Who is typically tasked with driving company-wide compliance with NDPA at an organization?

Compliance Officer

Legal

Data Protection Compliance Organisation

Data Protection Officer

None

_________is fundamentally linked to fairness. Its processing is about being clear, open and honest with people from the start about who you are, how and why you use their personal data

Transparency

Data display

Audit/sharing information with regulators

Opening up

None

The two types of data we have are?

Electronic and soft

Manual and electronic

Manual and visual

Manual and hard

None

When can we say data misuse has occurred?

When consumers feel that the company should sell goods at a cheaper rate to them

When consumers are unpleasantly surprised about the way they were attended to

When consumers are unpleasantly surprised that data about them has been collected or that it has been used in new ways

When consumers are unpleasantly surprised that the company’s staff are rude

None

The primary legislation governing data protection in Nigeria is the:

Nigerian Privacy Act 2023

National Information Security Act 2022

Nigeria Data Protection Act 2023

Freedom of Information Act 2011

None

A company can rely on a data subject's consent to process their data. However, such consent must be:

Implied by the data subject's continued use of the company's website.

Obtained through pre-checked boxes on online forms.

Renewed every year, regardless of the original purpose for data collection

Freely given, specific, informed, and unambiguous

None

When considering cybersecurity, what factors should you look at?

All of the above

Data security

System security

Online security

None

Which of these is not a factor to look at when considering physical security?

how you keep IT equipment, particularly mobile devices are secure

how you control access to your premises, and how visitors are supervised

how to engage security men in searching for stolen items

the quality of doors and locks, and the protection of your premises by such means as alarms or CCTV

None

A key objective of the NDPA is to:

Ensure data processing is fair, lawful, and accountable

Promote economic growth through data collection

Restrict access to government information

Encourage the sharing of personal data without limitations

None

A data breach has occurred at your company. The NDPA requires the company to:

Report the breach to the media to raise public awareness.

Offer affected data subjects free credit monitoring for a limited time.

Notify the Data Protection Commission within 72 hours in all breach cases

Only notify affected data subjects if the breach involves financial data.

None

1 out of 25

Time's up

Time is Up!

Title