Data Privacy Principles and Governance
What this domain tests
This domain tests whether you can turn the Art 5 principles into operational rules a business can be audited against, and describe the governance machinery that produces evidence. Questions often present a plausible-sounding practice and ask which principle it breaches, or which governance artefact would have prevented it.
Principles as testable rules
- Lawfulness, fairness, transparency. Transparency is discharged through Art 13/14 notices: identity, purposes, basis, recipients, transfers, retention, rights and complaint route.
- Purpose limitation. A new purpose needs either compatibility with the original under the Art 6(4) test, or a fresh lawful basis. The compatibility factors are the link between purposes, the context of collection, the nature of the data, possible consequences and existing safeguards.
- Data minimisation. Adequate, relevant and limited to what is necessary. Challenge every field at collection.
- Accuracy. Reasonable steps to keep data correct, with a rectification route.
- Storage limitation. Retention schedules with defined triggers and deletion evidence; no indefinite 'just in case' retention.
- Integrity and confidentiality. Art 32 security, proportionate to risk.
- Accountability. Art 5(2) plus Art 24: you must be able to demonstrate compliance, not merely assert it.
Governance machinery
- The DPO must be independent, report to the highest management level, have no conflicting duties, and be involved properly and in time (Arts 37-39). The DPO advises and monitors; the business decides.
- Programme components: policy hierarchy, RoPA upkeep, DPIA workflow with screening thresholds (Art 35(3)), prior consultation (Art 36), training and awareness, DSAR handling, incident linkage, vendor due diligence, and metrics such as DPIA completion rates, DSAR SLA attainment and retention compliance.
- Three lines model: the business owns the risk, privacy/compliance monitors in the second line, internal audit assures in the third.
Worked example
A marketing team wants to reuse purchase history for lookalike advertising. Purpose limitation is the first question: the Art 6(4) factors point towards incompatibility because the new purpose (audience building) differs in context from order fulfilment, and the consequences include unexpected profiling. The fallback is a legitimate interests basis plus a documented balancing test, combined with a right to object and an opt-out, and refreshed retention. Because cookies are involved, ePrivacy consent still applies. Reasoning: principle first, then basis, then safeguards.
Traps that cost marks
Treating the principles as aspirational statements rather than auditable rules; assuming every new purpose needs consent; believing the DPO must approve each processing operation; equating accountability with documentation alone; skipping the legitimate-interests balancing test.