International Data Protection and Privacy Law
What to know
Privacy law questions hinge on roles, lawful bases, and cross-border mechanics. Learn the GDPR vocabulary: controller (determines purposes and means) vs. processor (acts on instructions), data subject rights (access, rectification, erasure, portability, objection), lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests), and core principles such as purpose limitation, data minimization, storage limitation, and accountability. Understand international transfer mechanisms - adequacy decisions, standard contractual clauses, binding corporate rules - and the Schrems II consequence that transfers require a transfer impact assessment. Know that breach notification to a supervisory authority generally applies within 72 hours where there is risk to individuals.
Traps
Role confusion is the classic trap: an organization can be a controller for HR data and a processor for client data. Consent is not always the right basis, and "consent" obtained under imbalance of power may be invalid. Another trap: privacy law follows the data subject, not the server location, so processing in a low-regulation country does not remove obligations. Distinguish anonymization (outside scope) from pseudonymization (still personal data).
Worked example / rule of thumb
A US SaaS vendor stores EU employee data for an EU client. The client is controller; the vendor is processor; a data processing agreement is required; transfer needs an adequacy decision or SCCs plus a transfer impact assessment. Rule of thumb: ask who decides why (controller) and who acts how (processor), then ask where the data travels and on what legal mechanism.
Exam focus
Expect scenario questions testing role assignment, lawful basis selection, and whether a transfer mechanism is valid.