Which Data Protection Principle Does Posting a Customer Data Notice Apply?

CDPSE By islever Editorial Last updated

Short answer

C Data use limitation

Question

An online business posts its customer data protection notice that includes a statement indicating information is collected on how products are used, the content viewed, and the time and duration of online activities. Which data protection principle is applied?
  1. Data integrity and confidentiality
  2. System use requirements
  3. Data use limitation Correct Answer
  4. Lawfulness and fairness

Key Takeaways

The exam trap is confusing the wording of the notice—which is about transparency—with the separate principle of data use limitation, which restricts how data is used after collection.

Posting a customer data protection notice that reveals what information is collected (product usage, content viewed, time and duration) primarily supports the transparency component of the lawfulness and fairness principle. Although many CDPSE candidates choose data use limitation, the act of informing users about data collection aligns with lawfulness and fairness, not use limitation.

Common mistake: The most common wrong answer is C, Data use limitation, because the notice describes the categories of data being collected. However, the notice tells users what is collected, not what the business will not do with it; transparency is a hallmark of lawfulness and fairness.

Expert Analysis

Why the Answer Is Correct

Option D, Lawfulness and fairness, is the appropriate principle because posting a data protection notice and disclosing the types of data collected (product usage, content viewed, time and duration) fosters transparency. The lawful and fair processing requirement includes transparency to data subjects, as highlighted in comment [1] which states that the notice 'provides transparency to the customers.' This aligns with GDPR Article 5(1)(a) and broader privacy frameworks that require fair and transparent processing. The scenario is a disclosure action, not a restriction on future use.

Why the Other Options Are Wrong

Option C, Data use limitation, would apply if the notice explicitly restricted the company from using the data for purposes other than those stated, but the scenario only states what data is collected, not how it will be used. Option A, Data integrity and confidentiality, concerns security controls and unauthorized access, which are not relevant here. Option B, System use requirements, is not a recognized data protection principle; it relates to acceptable use policies for organizational systems, not customer notices. Thus, only D captures the transparency aspect that the posting demonstrates.

Community Comment Notes

Comment [1] (votes=1) correctly identifies the lawfulness and fairness principle, pointing out that the notice informs users about data collection, thereby providing transparency. Comments [2] and [3] only state 'C' without explanation, reflecting a common but unsupported choice. Comment [4] (votes=1) gives 'D' again, supporting the correct answer. The majority vote (75% C) likely arises from misreading the notice as a use limitation statement rather than a transparency measure.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Look for the key action in the scenario: posting a notice that informs data subjects about data collection is a transparency measure, so choose Lawfulness and fairness. If the question talks about a restriction on processing for different purposes, that's Data use limitation. Remember that transparency is part of 'lawfulness, fairness, and transparency' in modern privacy frameworks.

Community Votes

C
75%
D
25%

75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. 4dfe785 👍 1 Answered D
    This principle ensures that personal data is collected, processed, and used in a lawful, transparent, and fair manner. By posting a customer data protection notice and informing users about the types of data being collected (such as product usage, content viewed, and activity duration), the organization is providing transparency to the customers. This aligns with the lawfulness and fairness principle because it ensures that users are aware of what data is being collected and can make informed decisions about using the service.
  2. Craigp990i 👍 3 Answered C
    C. Data use limitation
  3. mmus 👍 1
    D. Lawfulness and fairness

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is the Greatest Privacy Concern with a Third-Party Virtualized Workspace?

S-grade

Data Migration with Outdated Documentation: What Should Be Done Next?

S-grade

Which Should Be the First Consideration in Data Sanitization Method Selection?

S-grade

Which scenario poses the greatest privacy risk: lacking hardware disposal policy or unencrypted internal emails?

S-grade

Practice All CDPSE Questions

Access 229 questions with complete answers and detailed explanations.

View Full CDPSE Practice Test →

← Back to CDPSE Study Guide