Module 19 self-check | AI GRCA Practitioner Programme

Why is 'human review vs rubber-stamping' a recurring theme across both ISO/IEC 42001 oversight controls and UK GDPR ADM safeguards?

Both frameworks recognise that nominal human presence without real engagement fails to provide genuine protection against automated harmGDPR and ISO 42001 define 'meaningful review' completely differently with no overlapOnly ISO 42001 addresses this concern; GDPR does notIt's coincidental and has no shared underlying principle

What does DPIA screening determine?

Whether the model is generative or classic AIWhether the vendor is profitableWhether the processing is likely high risk and needs a full DPIAWhether consent is always required

What should a plain-language AI privacy notice for an automated decision include?

Relevant data use, the decision's effect, safeguards and how to challenge itThe model's source codeA guarantee of accuracyOnly the vendor's name

How does 'fairness' as a UK GDPR principle differ from simply having a lawful basis for processing?

Only lawfulness matters; fairness is not a separate UK GDPR principleThey are identical requirementsFairness concerns whether processing is reasonably expected and not unduly detrimental to the individual, which is a distinct question from whether a lawful basis technically existsFairness has no independent meaning beyond lawfulness

What would a 'right of access' request typically entitle someone to, regarding an AI-scored decision about them?

Confirmation that their data is being processed and access to relevant information about that processing, including relevant automated decision-making detailsOnly the right to complain to a regulator, not to see their own dataThe right to delete the AI model itselfNothing related to the AI processing

Processing criminal offence data for an AI-driven vetting tool requires:

This type of data cannot be processed under any circumstancesOnly consent is ever a valid basis for this data typeNo additional condition beyond a standard lawful basisAn additional specific condition under UK data protection law, beyond the standard lawful basis and special category rules

Which of these is a 'special category' of data under UK GDPR?

Data concerning healthA person's job titleA person's employer nameA person's postcode

Why are 'vulnerable groups' given specific attention in AI and privacy guidance?

Only children count as a vulnerable group under any circumstancesVulnerability is irrelevant to privacy risk assessmentVulnerable groups require no special consideration under UK GDPRThey may be less able to understand, exercise rights over, or challenge how an AI system processes their data, warranting extra protective consideration

Which lawful basis is most likely appropriate for processing necessary to decide whether to enter a loan contract a customer has requested?

ConsentContractPublic taskLegitimate interests only, never contract

UK GDPR, DUAA, DPIA and AI Privacy