Scenario:PickFoodis an onlinefood delivery servicethat allows customers to order foodonlineand pay bycredit card.

UnderArticle 30(1) of GDPR, controllers and processors must document details such asdata processing purposes, categories of data subjects, and security measures, butdo not need to store detailed transaction amounts or items purchasedunless required for compliance.

Option D is correctbecausedetailed transactional information is not a mandatory requirement in the processing records.

Option A is incorrectbecausesecurity measures must be documented.

Option B is incorrectbecausedata retention periods must be includedin records.

Option C is incorrectbecausecross-border data transfers must be documented.

References:

GDPR Article 30(1)(f)(Controllers must document data transfers)

Recital 82(Record-keeping requirements for accountability)