A company's privacy notice describes purposes and rights but never names the controller or provides required DPO contact details where a DPO is designated. What Art. 13/14 gap does that create?
Select an answer to reveal the explanation.
Short Explanation
A notice without "who we are" and how to reach the DPO (when you have one) is like a letter with no return address. GDPR expects controller identity and key contacts so people know whom they are dealing with.
Full Explanation
Articles 13 and 14 require identity and contact details of the controller and, where applicable, of the controller’s representative and of the data protection officer. A notice that describes purposes and rights but omits who is accountable and how to reach the DPO (when one is designated) leaves people unable to exercise rights effectively or to know which organisation answers for the processing. Civic agencies and private firms both fail transparency when accountability contacts are missing from the notice surface that residents or customers actually see.
Social-media hashtags, Pearson VUE scheduling codes, and EU AI Act conformity serial numbers for CRM fields are not Article 13/14 mandatory content and do not cure missing controller or DPO identity. Those distractors test whether candidates can separate GDPR transparency content from unrelated compliance or branding artefacts.
Exam caveat: DPO contact details are required in the notice where a DPO is designated; not every controller must appoint a DPO, but when one exists, hiding the contact undermines Articles 13/14 and Article 37–39 visibility expectations. Representative details matter for certain non-EU controllers under Article 27.
Operational check: open the live privacy notice and confirm controller legal identity, postal or equivalent contact, DPO contact if designated, and consistent RoPA entries; fix any “purposes only” stub pages before the next release.