Answer For The Right Role
Some questions are hard because the law is hard. Others are hard because all four options describe something a real organisation would properly do, just not the organisation you were asked about. That second kind is not a knowledge gap. It is a reading habit, and answering for the right role fixes it.
Every scenario tells you who you are. It is usually one clause, dropped in early and easy to skim past: you advise the controller, your client is the processor, the company deploys a system built by somebody else. Find that clause first and half the options stop competing.
Find the right role before you read the options
Read the stem twice before you look at A to D. On the second pass you are hunting for one thing only: the role whose decision is being tested. Write it at the top of your rough sheet if you get one, or hold it in your head as a single word.
Then read each option with the same question attached. Whose role is this? An option can be a textbook-perfect action and still be wrong, because the actor performing it is not the actor in front of you.
The roles that keep coming up
On the privacy side there are five: controller, joint controller, processor, data protection officer and supervisory authority. On the AI governance side there are four: provider, deployer, importer and distributor. Nine roles, and the same obligation lands differently on each.
Learn them as pairs of “can” and “cannot” rather than as definitions. A processor can act on documented instructions and can notify the controller of a breach without undue delay under Article 33(2) of the GDPR. A processor cannot decide the purpose, and does not notify the supervisory authority. Hold that pair and a whole class of options falls away.
Distractors built from the wrong role
Question writers do not need to invent falsehoods to build a hard question. They only need to borrow a true statement from a neighbouring role. It is cheap to write and it works, because a true sentence feels correct even when it is answering a question nobody asked.
Two patterns show up again and again.
The adviser who is asked to decide
Where the stem makes you the DPO, watch for options that make a decision. Article 39 gives the DPO five tasks: inform and advise, monitor compliance, advise on data protection impact assessments and monitor their performance, cooperate with the supervisory authority and act as its contact point. Not one of them is a decision. If an option has you approving the processing, halting the launch or signing off the assessment, it belongs to management, and you can strike it out without knowing anything else about the scenario.
The deployer who is asked to fix the model
The AI side has its own version. Where the stem makes you the deployer of a system somebody else built, an option that has you retraining the model or correcting the training data is describing the provider’s job. Under Article 26(5) of the EU AI Act, a deployer with reason to consider that the system presents a risk informs the provider or distributor and the market surveillance authority, and suspends use. Inform and suspend, not repair.
Watch for the role that moves
One complication is worth knowing before it catches you. A role is not fixed for the whole scenario. A processor that starts using the data for its own purposes becomes a controller for that processing. Two organisations that jointly determine purposes and means are joint controllers, whatever the contract calls them.
Longer scenarios sometimes turn on exactly this shift, and the sentence that causes it is often buried in the middle paragraph. If the options seem to disagree about which role is acting, that is your signal to go back and read for a change of role rather than a change of obligation.
A drill for this week
Take ten questions you have already answered, from any practice set. Cover the options. For each stem, write down the role in one word, then write what that role can and cannot do here, in two short lines. Only then uncover the options.
You will notice two things. Some questions become almost trivial. And on the ones you got wrong the first time, the wrong answer will often turn out to have been correct for somebody else in the room.
Why the right role saves marks
This is a cheap habit with a good return. It costs about ten seconds a question and it removes distractors that would otherwise survive to the final two, where the close calls happen. It also pairs neatly with two methods we have covered before: right answer, wrong stage catches options that are correct but early or late, and spot the second obligation catches the duty hiding behind the obvious one.
Run the role drill on your next practice set before you look at anything else, and see how many of your near-misses were simply the right answer given by the wrong person. If you want structured material to practise on, the study resources at 22academy.com/study are organised by domain.
