Privacy
What the exam tests
Privacy items test whether you can apply principles to a concrete data flow: what the lawful basis is, what notice was given, how long data is kept, where it travels, and what happens when it goes wrong. The exam expects GDPR-shaped reasoning even where another regime applies.
Principles (GDPR Art. 5)
Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. Accountability is the operational one: you must be able to demonstrate compliance, not merely intend it.
Lawful basis
Six bases under Art. 6: consent, contract, legal obligation, vital interests, public task, legitimate interests. Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Consent is not a default - it is often the weakest basis in employment or mandatory-service contexts. Special category data (Art. 9) needs an additional condition on top of a lawful basis.
Roles and rights
A controller determines purposes and means; a processor acts on documented instructions. A processor that starts deciding purposes becomes a controller for that processing. Data subject rights: access, rectification, erasure, restriction, portability, objection, and rights around automated decision-making. Respond within one month, extendable by two further months for complex requests.
Transfers, design and incidents
International transfers rely on an adequacy decision, SCCs, BCRs or a narrow derogation. Privacy by design and by default (Art. 25) means building minimisation and retention into the system. A DPIA is required for high-risk processing: systematic monitoring, large-scale special category data, or new technology. Personal data breaches go to the supervisory authority within 72 hours of awareness where rights are at risk, and to individuals where the risk is high.
Worked example
An online retailer wants to email past customers about a similar product. Soft opt-in may apply if the address was obtained in a sale, the marketing concerns similar products, and an opt-out was offered at collection and in every message. If the retailer instead rents a purchased list, no such basis exists and prior consent is required.
Traps
- Assuming pseudonymised data is out of scope - it remains personal data.
- Treating "publicly available" as an unrestricted licence to process.
- Using consent where it cannot be freely refused.
- Missing the 72-hour clock, which runs from awareness, not from full confirmation of scope.