Free sample activity · Employees & training teams

Data Privacy Basics Practice

These fictional workplace decisions introduce data-handling concepts. They are not legal advice or evidence of compliance with any privacy law. Check your organization's approved rules and responsible privacy or security contact for real situations.

Try the Activity Read questions & explanations

6 questions · No account · No timer · Immediate feedback

Before you begin

How to use this activity

Allow five to ten minutes. Follow the policy stated in each question. Use invented examples only; do not enter real personal information or incident details.

This is a short knowledge check. For BrainFusion gameplay, explore Quiz Quest or the shared game library.

Try a knowledge check 6 questions · No account needed

Put it into practice

Choose an answer, read the explanation, then move to the next question. Your answers stay in this page and are not saved.

Collecting only what is needed

A fictional event policy permits collecting a contact email but not a birth date. Which registration form follows it?

A form requesting only the permitted email. A form requiring email and birth date. A form asking for identity documents as well.
Answer: A.

Collect the information the stated purpose and policy permit. Extra fields are not justified simply because a form can include them.

Access for a task

A colleague needs one approved contact for a task. The fictional policy limits access to what the task requires. What follows it?

Send the entire customer database. Provide only the authorized information through the approved channel. Share a team password so they can search freely.
Answer: B.

Limit sharing and access to the authorized task. The scenario does not authorize the complete database or a shared password.

Sending information

The fictional policy requires restricted sharing with a verified recipient. What should you check before sending a file with personal information?

Only whether the file has a short name. Whether a public link is easier to copy. The recipient and access settings in the approved sharing tool.
Answer: C.

Check who will receive the file and who can open it. A convenient link does not establish restricted access.

Retention decisions

A record has reached its scheduled deletion date, but a documented hold says preserve it. The fictional policy says holds override routine deletion. What follows the policy?

Preserve it and confirm next steps with the responsible records contact. Delete it immediately despite the hold. Copy it to a personal account for safekeeping.
Answer: A.

The explicit hold controls this scenario. Follow the responsible process rather than deleting on schedule or making an unauthorized personal copy.

A possible disclosure

You accidentally sent personal information to the wrong recipient. The fictional policy requires prompt reporting to the privacy team. What should you do?

Wait until someone complains. Report through that route promptly and follow its instructions. Ask coworkers to circulate the file to identify it.
Answer: B.

Promptly use the stated incident route. The responsible team can assess what happened and direct the response; this question does not set legal notification deadlines.

Using a new service

A new web service asks for employee records. The fictional policy requires privacy review before using new services with those records. What follows the policy?

Upload a small real sample before requesting review. Assume a service's popularity means approval. Complete the required review before transferring records.
Answer: C.

The scenario requires review before transfer. A small sample can still contain personal information, and popularity does not establish approval.

This activity demonstrates questions and feedback. Explore Quiz Quest or the shared game library using the links above to try BrainFusion gameplay.

Keep the reasoning

All questions, answers & explanations

Use this review before or after practice. You can read and print it without JavaScript.

  1. Collecting only what is needed

    A fictional event policy permits collecting a contact email but not a birth date. Which registration form follows it?

    Answer: A form requesting only the permitted email.

    Collect the information the stated purpose and policy permit. Extra fields are not justified simply because a form can include them.

  2. Access for a task

    A colleague needs one approved contact for a task. The fictional policy limits access to what the task requires. What follows it?

    Answer: Provide only the authorized information through the approved channel.

    Limit sharing and access to the authorized task. The scenario does not authorize the complete database or a shared password.

  3. Sending information

    The fictional policy requires restricted sharing with a verified recipient. What should you check before sending a file with personal information?

    Answer: The recipient and access settings in the approved sharing tool.

    Check who will receive the file and who can open it. A convenient link does not establish restricted access.

  4. Retention decisions

    A record has reached its scheduled deletion date, but a documented hold says preserve it. The fictional policy says holds override routine deletion. What follows the policy?

    Answer: Preserve it and confirm next steps with the responsible records contact.

    The explicit hold controls this scenario. Follow the responsible process rather than deleting on schedule or making an unauthorized personal copy.

  5. A possible disclosure

    You accidentally sent personal information to the wrong recipient. The fictional policy requires prompt reporting to the privacy team. What should you do?

    Answer: Report through that route promptly and follow its instructions.

    Promptly use the stated incident route. The responsible team can assess what happened and direct the response; this question does not set legal notification deadlines.

  6. Using a new service

    A new web service asks for employee records. The fictional policy requires privacy review before using new services with those records. What follows the policy?

    Answer: Complete the required review before transferring records.

    The scenario requires review before transfer. A small sample can still contain personal information, and popularity does not establish approval.

Take it one step further

Find your organization's approved guidance for collecting data, granting access, retaining records, and reporting a suspected disclosure. Identify the contact who can resolve a conflict.

Background reading

BrainFusion wrote the practice questions. These references explain background concepts; they do not endorse this activity.

Bring your own content

Make the next activity yours.

Create a BrainFusion learning game from a topic, enter your own questions, or import a question set. Review the content, choose a game format, and share it with learners in their browser.

Create a Game FreeGames for corporate training

The free plan includes a five-game limit and three one-time AI generation credits.