Data Protection Law and Regulatory Frameworks
What this domain tests
Framework questions are scenario questions: a fact pattern names an organisation, a data type and a jurisdiction, and asks which law applies, in what role the organisation acts, and what obligation follows. You need the GDPR architecture cold, plus enough CCPA/CPRA, LGPD and PIPL to spot where a second regime layers a parallel duty onto the same processing.
Core rules
- Roles. The controller determines purposes and means (Art 4(7)); the processor acts only on documented instructions (Art 4(8), Art 28). Joint controllership (Art 26) turns on jointly determined purposes, not on contract wording. A vendor that reuses data for its own purposes stops being a processor for that processing.
- Lawful basis. Art 6 offers six bases: consent, contract, legal obligation, vital interests, public task, legitimate interests. Special-category data needs an Art 9(2) condition stacked on top of an Art 6 basis. Consent must be freely given, specific, informed and unambiguous (Art 4(11), Art 7); explicit consent is required for Art 9 data.
- Scope. Art 3(1) applies via establishment; Art 3(2) applies to non-EU organisations that offer goods or services to, or monitor, EU data subjects.
- Rights and accountability artefacts. Access, rectification, erasure, restriction, portability, objection and Art 22 automated-decision safeguards. Evidence comes from the RoPA (Art 30), DPIA (Art 35), DPO appointment (Arts 37-39) and the breach register (Art 33(5)).
- Penalties. Two GDPR tiers: up to EUR 10m or 2% of worldwide annual turnover, and up to EUR 20m or 4%, whichever is higher.
- Other regimes. CCPA/CPRA uses business, service provider and contractor roles, with thresholds and rights to opt out of sale/share and to limit sensitive PI; LGPD has ten legal bases including legitimate interest with a balancing test; PIPL requires separate consent and its own cross-border routes.
Worked example
An Irish retailer embeds a US analytics script that profiles EU visitors. Art 3(1) applies through establishment, and Art 3(2) would apply to the vendor anyway because profiling is monitoring. The retailer is controller; the vendor is processor only if it never uses the data for its own purposes. Because cookies are involved, ePrivacy consent is needed before the script fires, independently of the Art 6 basis for the analytics itself. Any US access is a Chapter V transfer requiring SCCs plus a transfer impact assessment. Reasoning: role first, then lawful basis, then scope, then transfer route.
Traps that cost marks
Taking a contract label as proof of processor status; treating consent as the default basis for everything; forgetting the Art 9 condition when an Art 6 basis is present; mixing the two fine tiers; treating an adequacy decision as a contract; ignoring Art 3(2) because the organisation has no EU entity.