Privacy and Regulatory Compliance
Privacy and Regulatory Compliance tests whether you can map an activity to its lawful basis, identify controller and processor roles, and get cross-border transfers right. Questions usually describe a new feature or vendor and ask what must exist before launch.
GDPR foundations
Seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. Six lawful bases exist - consent, contract, legal obligation, vital interests, public task, legitimate interests - and consent is neither the default nor the best choice for employment or service-delivery contexts, where it is rarely freely given.
A data protection impact assessment is required for high-risk processing: systematic profiling, large-scale special-category data, or systematic monitoring of a publicly accessible area.
Data subject rights - access, rectification, erasure, restriction, portability, objection - must be answered within one month, extendable by two for complexity. Controllers decide purpose and means; processors act on documented instruction under an Article 28 contract that must flow obligations down the chain.
Transfers and other regimes
Cross-border transfers need an adequacy decision, or standard contractual clauses plus a transfer impact assessment, or binding corporate rules. CCPA/CPRA grants rights to know, delete, correct and opt out of sale or sharing, with a 45-day response window and limits on sensitive personal information. HIPAA requires minimum necessary use, Security Rule safeguards and business associate agreements. PCI DSS v4.0 organises controls into twelve requirements and is enforced contractually by the card brands.
Worked example
Marketing wants a US-hosted analytics vendor to profile EU customer behaviour. Reasoning: first settle the lawful basis - legitimate interests with a documented balancing test, or consent if the profiling is intrusive. Apply minimisation so the vendor receives pseudonymised identifiers, not raw contact data. Run a DPIA because this is systematic profiling. Sign an Article 28 data processing agreement. Put standard contractual clauses in place and complete a transfer impact assessment covering US access risk. Configure retention and a data subject request workflow. Only then launch.
Traps that cost marks
Calling pseudonymised data anonymous - it is still personal data. Defaulting to consent everywhere. Skipping the processor contract or failing to flow obligations to sub-processors. Assuming an adequacy decision exists for a new destination. Ignoring the one-month data subject response deadline.