GDPR Practice Question: Under GDPR, can a controller rely on more than one lawful basis for... | CyberCertPrep
EUGDPRLawful BasesEASYFree question
Under GDPR, can a controller rely on more than one lawful basis for the same processing activity?
A.No, only one basis may ever apply
B.Yes, but the primary basis must be identified in advance and documented
C.No, multiple bases are explicitly prohibited
D.Yes, and no documentation is needed
Why B is correct
While a controller should identify and document the most appropriate lawful basis before processing begins, the EDPB recognises that in some situations more than one basis may apply, though the primary one should be clearly identified.
Know someone studying for GDPR? Send them this one.
Where this fits in the GDPR exam
Lawful Bases
Covers lawful bases concepts and practices within GDPR.
This question belongs to the "Principles & Lawful Basis" domain, which makes up about 20% of the GDPR exam.
CyberCertPrep gives you 20 free GDPR questions per day with this same answer-and-explanation depth, plus timed exam simulations and progress tracking. No card required.
GDPR and EU are trademarks or registered trademarks of their respective owners. CyberCertPrep is an independent exam-preparation resource and is not affiliated with, authorized by, sponsored by, or endorsed by EU or any other certification body. All study material is independently created; the certification name is used only to identify the exam this resource helps you prepare for.
The vital interests basis is generally reserved for situations involving: