Map each processing purpose to its GDPR role: What is the most | AIGP
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

Map each processing purpose to its GDPR role: What is the most direct missing control?

AIGP Understanding How Laws, Standards and Frameworks Apply to AI Hard

Separate purposes must be mapped because GDPR roles follow actual decision-making, not the vendor’s label.

The question

Under the EU GDPR, a university selects an AI vendor to rank applicants. The university determines the ranking purpose, while the vendor also analyzes applicant logs for its own product analytics. Lawful basis, transparency, security, and rights processes are otherwise complete. What is the most direct missing control?

Preparing for AIGP? Take the free 5-min readiness quiz →

  1. Map each processing purpose to its GDPR role ✓
    The university’s ranking may involve a processor relationship, while the vendor’s own analytics may make it a controller for that activity; the purposes must be separated and assigned accordingly.
  2. Accept the vendor’s processor label for every processing activity
    A supplier label cannot override the actual purposes the vendor independently determines for its analytics activity.
  3. Require the vendor to stop all applicant-log analytics
    Stopping analytics may change the facts, but the organization must still classify and govern the remaining ranking processing correctly.
  4. Add ranking-service processor clauses to the contract
    Processor clauses may address ranking on the university’s behalf, but they do not classify or govern the vendor’s separate analytics purpose.
The trap
Split the processing into activities and ask who determines the purpose and essential means of each.

How to remember it

Separate purposes must be mapped because GDPR roles follow actual decision-making, not the vendor’s label.

How many of these would you get right?

One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.

Test your AIGP readiness — free

More Understanding How Laws, Standards and Frameworks Apply to AI questions

Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI · Every answer, right and wrong, comes with its own explanation.