Practise the language of data subject access requests: verifying identity, the response deadline, scope of data, and right to erasure.
0 / 10 completed
1 / 10
A DSAR is a request by a ___ to access the personal data an organisation holds about them.
The data subject (the individual) has the right under laws like GDPR to request access to their personal data.
2 / 10
Before fulfilling a DSAR you must ___ the requester to prevent disclosing data to the wrong person.
Identity verification stops attackers from using a DSAR to exfiltrate someone else's personal data.
3 / 10
Under GDPR, organisations generally must respond to a DSAR within ___.
GDPR sets a default of one month (extendable for complex requests), making timeliness a compliance requirement.
4 / 10
A request to delete personal data exercises the right to ___.
The right to erasure ('right to be forgotten') lets individuals request deletion of their data, subject to legal exceptions.
5 / 10
Identifying every system holding the requester's data so the response is complete relies on a data ___.
A data map/inventory tells you where personal data lives, which is essential to answer a DSAR fully and accurately.
6 / 10
During a code review of the user profile update API, Alice points out that the service doesn't currently log when a DSAR request is received. Bob replies: 'That's fine; we don't need to track those – they're infrequent.' Which statement best reflects the appropriate response regarding DSAR handling in this scenario? track-dsar-requests
Bob's response overlooks the importance of auditing and compliance related to DSARs. While infrequent, these requests are legally mandated, and logging provides a critical record for demonstrating adherence to regulations like GDPR. Ignoring this potential issue could lead to significant legal or reputational problems later on. The API should be designed with future needs in mind.
7 / 10
Sarah, a Data Governance Analyst, is drafting the description for a Pull Request to update the company's DSAR response process. She writes: 'This PR implements automated data extraction from all relevant databases.' Which of the following best improves Sarah's wording to be more precise and compliant with legal requirements? improve-dsar-pr-description
While automation is beneficial, Sarah needs to explicitly acknowledge the security aspects surrounding DSAR responses. 'Secure data extraction' highlights the necessity for robust measures to protect personal data during retrieval and transfer – a crucial element of GDPR compliance. Focusing solely on implementation risks overlooking the legal obligations associated with handling sensitive information.
8 / 10
During a standup meeting, David mentions he's receiving DSAR requests. Maria asks, 'How are you managing those? Are we properly documenting the requests and their fulfillment?' Which of the following is the MOST important immediate action David should take to address this situation? implement-dsar-tracking
David needs a formalized system to track DSAR requests – this demonstrates accountability and allows for monitoring of response times. Without tracking, it's impossible to assess whether the process is functioning correctly or if there are potential bottlenecks. Simply acknowledging receipt doesn't provide any valuable information for ensuring compliance.
9 / 10
As a Senior Developer, you're reviewing a Slack message from a junior engineer discussing the handling of a DSAR request. The message reads: 'I just sent the user their data – it was pretty easy to find.' What is the MOST critical thing the junior engineer needs to understand and communicate? emphasize-data-handling-procedures
The message highlights a potential breach of protocol – data access should never be 'easy' or reliant on individual judgment. All data handling must follow documented security procedures to ensure privacy and prevent unauthorized disclosure. This reinforces the importance of standardized processes and controls for DSAR fulfillment.
10 / 10
During a discussion about improving the company's DSAR response process, Emily suggests using a 'data map' to identify all systems holding personal data. What does she mean by this? define-data-map
A 'data map' is a crucial tool for fulfilling DSAR requests effectively. It provides a detailed overview of all systems – databases, applications, servers – where personal data might be stored. This allows the team to identify *every* relevant source and ensures a complete response, minimizing the risk of non-compliance.
This is a Privacy Engineering exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of privacy engineering terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the privacy engineering vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Privacy Engineering exercises?
See the Privacy Engineering exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — privacy engineering vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.