OneTrust Certified Privacy Professional Practice Exam

TRUE OR FALSE: Data controllers are generally required to keep records of processing activities.

1. True

2. False

3. Only for sensitive data

4. Only if processing exceeds certain volumes

The correct answer is: True

Data controllers are generally required to keep records of processing activities as a fundamental obligation under various data protection regulations, such as the General Data Protection Regulation (GDPR) in the European Union. This requirement serves several important purposes: it enhances transparency, enables accountability, and facilitates compliance checks by supervisory authorities. The necessity of maintaining records helps ensure that data controllers have a clear understanding of what personal data they process, the reasons for processing, and who has access to that data, which is crucial for safeguarding individuals' rights. This obligation applies broadly, not just to specific types of personal data or based on the volume of data processed, ensuring that all processing activities are documented for accountability and oversight. In contrast, the other options suggest limitations or conditions under which record-keeping is necessary, which does not align with the overarching requirements set by data protection laws that emphasize consistent documentation by data controllers.