Data Privacy, Protection, and Cross-Border Data Policy
Foundations
Separate privacy (rules about personal data and individual rights) from security (protecting confidentiality, integrity, availability). Privacy principles to know: lawful basis, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, and accountability. Individual rights typically include access, correction, deletion, portability, and objection.
Know the roles: controller determines purpose and means; processor acts on the controller's instructions. A processor that starts deciding purposes may become a controller - a common trap. Joint controllers share responsibility. Contracts (DPAs) must impose processor obligations and flow down to sub-processors.
Cross-border transfers are a major exam area. Mechanisms include adequacy decisions, standard contractual clauses, binding corporate rules, and derogations for specific situations. Questions often test whether an adequacy finding is permanent - it is not; it can be revoked. Also know data localization mandates, which require data to remain in-country, and sovereignty concerns where foreign authorities may compel disclosure.
Traps: (1) Assuming consent is always the best lawful basis - it is one basis among several and can be withdrawn. (2) Confusing anonymization (outside privacy scope) with pseudonymization (still personal data). (3) Ignoring that transfer rules apply to remote access from abroad, not just physical movement.
Rule of thumb: For any data flow, ask: what data, whose rights, which lawful basis, where does it go, and what transfer mechanism covers it?