Which of the following is NOT one of the main GDPR obligations for an investment intermediary?

• A. A Process personal data fairly.
• B. B Keep personal data up to date.
• C. C Collect personal data only for one or more specified purposes.
• D. D Communicate with customers using plain intelligible language.

Answer: (A)

The concept being tested is which GDPR requirement is treated as a distinct obligation for an investment intermediary versus a broader processing principle. In GDPR, keeping data accurate, collecting only for specified purposes, and communicating information in clear, plain language are framed as explicit duties that guide processing. The idea of processing personal data fairly is a fundamental principle—part of lawful, fair, and transparent processing—rather than a separate, enumerated obligation. In this context, the fairness principle underpins all processing, while the other items describe concrete obligations. So, the statement about processing personal data fairly isn’t counted as one of the main enumerated obligations, making it the best choice.