GDPR Compliance Features in Power Platform

PL-900 By islever Editorial Last updated

Short answer

BD Prompt users for consent to use their personal data and record the date consented, and automatically deactivate a user who has not used the portal in six months.

Question

A company's customer-facing applications must comply with Global Data Protection Regulations (GDPR) regulations.
You need to recommend actions to help ensure GDPR compliance.
Which two features should the company use? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
  1. Force a user to update security questions after a specific amount of time.
  2. Prompt a user for consent to use their personal data and record the date consented. Correct Answer
  3. Block users who are identified as minors.
  4. Automatically deactivate a user who has not used the portal in six months. Correct Answer

Key Takeaways

The main trap is confusing general security practices (like password updates) or absolute restrictions (blocking minors) with specific GDPR requirements for documented consent and storage limitation.

This question addresses GDPR compliance in Microsoft Power Platform by identifying two essential features: managing user consent and enforcing data retention limits through automatic deactivation.

Common mistake: Many candidates incorrectly select C (Block users who are identified as minors) because they assume GDPR prohibits processing minor data entirely, whereas the regulation actually allows it with parental consent, making blocking an incorrect compliance strategy.

Expert Analysis

The question asks for features to ensure GDPR compliance in customer-facing applications. The key to solving this lies in understanding the specific data protection mechanisms provided by Microsoft Power Platform, particularly within Power Pages (formerly Power Apps Portals), which are designed for external user interactions.

Option B is correct because GDPR Article 7 requires that consent be freely given, specific, informed, and documented. Prompting users for explicit consent and recording the timestamp is a fundamental technical control for demonstrating lawful processing of personal data. This aligns with the 'Privacy' configuration settings in Power Pages where administrators can enforce consent collection.

Option D is correct because GDPR's principle of storage limitation (Article 5(1)(e)) mandates that personal data be kept no longer than necessary for the purposes for which it is processed. Automatically deactivating inactive users after a defined period (such as six months) helps organizations minimize the amount of retained personal data, thereby reducing privacy risks and ensuring compliance with retention limits. This is a standard governance practice supported by Power Platform administration tools.

Option A is incorrect because forcing security question updates is a cybersecurity best practice related to account integrity, not a direct GDPR requirement for data protection or privacy rights. Option C is incorrect because GDPR does not prohibit minors from using services; rather, it requires verifiable parental consent for children under a certain age (typically 13-16 depending on jurisdiction). Blocking all minors entirely is an over-correction and not a standard GDPR compliance feature offered out-of-the-box as a primary solution compared to consent and data minimization.

Comments in the source discuss B and D extensively, citing data retention and consent documentation. Some argue for C, but as noted, blocking is not the compliant alternative to parental consent—it is a refusal of service, which is not what GDPR mandates. The official Microsoft documentation for Power Pages GDPR implementation highlights consent management and data retention policies as core features.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When answering GDPR-related questions in PL-900, focus on the core principles of Lawfulness, Fairness, Transparency, and Storage Limitation. Look for options that involve obtaining explicit user consent, documenting that consent, or minimizing data retention time. Avoid options that represent broad security hygiene (like password policies) unless specifically tied to data access controls, and remember that GDPR regulates how data is handled, not necessarily prohibiting usage by specific demographics without proper legal basis.

Community Votes

B
50%
D
33%
C
17%

50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 28 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 28

  1. Anonymous learner 👍 27
    Is this a Power Platform test, or European Law test?? Crazy...
  2. d365developer 👍 22
    B and C https://docs.microsoft.com/en-us/powerapps/maker/portals/configure/implement-gdpr https://docs.microsoft.com/en-us/dynamics365/marketing/gdpr
  3. hdconsulting 👍 8
    It's B & D. GDPR does not disallow minors from using the platform (block minors) but requires parental consent. So blocking is not really an option. Under normal GDPR compliance conditions, companies cannot keep data for more than a specific duration unless consent is renewed, which makes D a sensible option for GDPR compliance. Ref: https://docs.microsoft.com/en-us/powerapps/maker/portals/configure/implement-gdpr
  4. rmziii 👍 8
    Why block users is it a porn site😂😂
  5. danialonso 👍 7
    GDPR establishes the minimum age for applying this law to 13 years. Therefore, it does make sense that users under the age of 13 should be removed. Here you have a clear example: https://slate.com/technology/2018/05/twitter-accounts-that-were-made-when-a-user-was-under-13-are-being-banned.html
Show 23 more comments
  1. Kamal_SriLanka 👍 4
    Answer is B and C confirmed https://docs.microsoft.com/en-us/powerapps/maker/portals/configure/implement-gdpr
  2. Naebun 👍 3
    Well, technically the "options" for GDPR in regards to minors is to get parental content or block them.
  3. COOKIE1901 👍 2
    correct answers are B and D. Option B: Prompt a user for consent to use their personal data and record the date consented is definitely correct. GDPR requires explicit consent from users for processing their personal data, and recording the date of consent is essential for compliance. Option C: Block users who are identified as minors is not a specific GDPR requirement. While protecting minors’ data is important, GDPR focuses more on obtaining consent, data minimization, and ensuring data subjects’ rights. Option D: Automatically deactivate a user who has not used the portal in six months aligns with GDPR’s principle of data minimization, which encourages organizations to retain personal data only as long as necessary.
  4. TechieBloke 👍 2
    I would go B & C - most likely. I wouldn't deactivate, what if someone doesn't use it often or don't need to be used often - like court or something.
  5. nmnm22 👍 2
    if only all social media apps follow this approach..
  6. BigM 👍 2
    These are the correct answers
  7. cookiemonster42 👍 2
    hahaha..lol
  8. iiiiiiiiii 👍 1
    I agree with answers B and D: GDPR requires: - sers must confirm that their personal data can be collected and a clear privacy policy must be made available that shows what personal data is going to be stored and how that data will be used. - GDPR Data Retention rules state that personal data should never be retained longer than strictly necessary to accomplish the set business purpose. This is of course a good thing to ensure everyone’s privacy as data that is deleted can no longer be (mis)used, exposed, hacked etc. Sources: -https://www.2dogsdesign.com/gdpr-wordpress-guide/ - https://gdprwise.eu/data-security/data-retention-and-gdpr/#:~:text=GDPR%20%E2%80%93%20Data%20Retention%20and%20Privacy%20Policy%20GDPR,can%20no%20longer%20be%20%28mis%29used%2C%20exposed%2C%20hacked%20etc.
  9. Dieformetal 👍 1
    I think I would go for B and D, while processing the data of minors is considered a special category and should be accompanied by the correct security measures, it is not necessarily illegal to process it, thus always locking them out makes no sense to me A could be a correct answer but is more related to cyber security than GDPR
  10. Akraios 👍 1
    You have the correct link but wrong answer :-D "Denies use of the portal by minors. By default, this is set to false." https://docs.microsoft.com/en-us/power-apps/maker/portals/configure/implement-gdpr
  11. MHub 👍 1
    I believe it's about the Power Pages sites, not Power Apps, and here's the link to these 2 requirements: https://learn.microsoft.com/en-us/power-pages/configure/implement-privacy
  12. sebastino 👍 1
    If you don't want to go through the effort of getting parental consent than just outright blocking them will still make you compliant.
  13. delpiero 👍 1
    lol hahaha ! c'est stupide comme idée de bloquer un mineur qui veut faire de l'apprentissage
  14. MHub 👍 1
    New link: https://learn.microsoft.com/en-us/power-pages/configure/implement-privacy
  15. abeltenera 👍 1
    Its all about privacy, not blocking or forcing
  16. PraveenGabriel 👍 1
    Verified - this appeared on 11/13/2021
  17. sibalkorean 👍 1
    No BD? It's a about Data Minimization
  18. techy9206 👍 1
    Verified Nov 4th 2021
  19. Khella 👍 1
    Verified 6/9/2021
  20. Maniula 👍 1
    It's 16, not 13.
  21. Johnnien 👍 1
    why six months?
  22. SandeshSandy1 👍 1
    hahaha lol...
  23. Johnnien 👍 1
    only B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Distributing Power BI Content Securely Using Apps

S-grade

Which Power Automate Components Log Support Emails to Excel?

S-grade

Which tool finds and fixes accessibility issues in a canvas app?

S-grade

Which Power Automate Flow Type Opens a Website and Reads Data?

S-grade

Practice All PL-900 Questions

Access 130 questions with complete answers and detailed explanations.

View Full PL-900 Practice Test →

← Back to PL-900 Study Guide