CIPP/E cheat sheet

Convention 108, opened by the Council of Europe in 1981, was the first binding international treaty on data protection; it was modernised as Convention 108+ in 2018.

The EU Charter of Fundamental Rights (2000) protects private life in Article 7 and personal data in Article 8; the Treaty of Lisbon (2009) made the Charter binding and added Article 16 TFEU as the data protection legal basis.

Directive 95/46/EC harmonised national data protection laws from 1995 until the GDPR (Regulation (EU) 2016/679) repealed it with effect from 25 May 2018.

A regulation is directly applicable in all Member States without transposition; a directive binds Member States as to the result to be achieved and must be transposed into national law.

Privacy and data protection are distinct: privacy (Article 8 ECHR) is framed as protection against interference, while data protection imposes positive fair-processing obligations on controllers.

Core actors: data subject, controller (determines purposes and means), processor (processes on behalf of the controller), supervisory authority, EDPB and EDPS.

Instruments outside the GDPR include the ePrivacy Directive 2002/58/EC (as amended in 2009) for electronic communications, Directive (EU) 2016/680 for law enforcement, and Regulation 2018/1725 for EU institutions.

Source hierarchy: Treaties and Charter (primary law) prevail over regulations and directives (secondary law), which prevail over delegated and implementing acts; CJEU and ECtHR case law interpret all of them.

Article 5 principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

Article 6 lawful bases: consent, contract performance, legal obligation, vital interests, public task, legitimate interests; public authorities may not use legitimate interests for their public tasks.

Article 9 prohibits processing special categories (racial or ethnic origin, political opinions, religion or belief, trade union membership, genetic, biometric for identification, health, sex life or orientation) unless a listed condition applies.

Consent (Article 4(11), Article 7) must be freely given, specific, informed and unambiguous, given by statement or clear affirmative action, separable from other terms, and withdrawable at any time.

Data subject rights: information (Articles 13-14), access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and protection from solely automated decisions (22).

Controller duties: responsibility (Article 24), data protection by design and by default (25), processor contracts (28), records of processing (30), security (32) and breach handling (33-34).

Breach rules: notify the supervisory authority within 72 hours of awareness unless unlikely to result in risk (Article 33); notify data subjects without undue delay where there is high risk (Article 34).

A DPIA is required where processing is likely to result in high risk, in particular systematic profiling with significant effects, large-scale special category processing, or systematic large-scale monitoring of publicly accessible areas (Article 35(3)).

Article 83 fines: up to EUR 10 million or 2% of worldwide annual turnover (whichever is higher) for organisational duties; up to EUR 20 million or 4% for principles, lawful bases, data subject rights and transfer rules.

Accountability (Article 5(2), Article 24) requires the controller not only to comply but to be able to demonstrate compliance through policies, records, DPIAs, training and audit evidence.

Article 30 records of processing must cover purposes, categories of data and data subjects, recipients, third-country transfers, retention periods and security measures; the 250-employee exemption does not apply where processing is non-occasional, involves special categories, or is likely to result in risk.

A DPO is mandatory for public authorities, for core activities involving large-scale regular and systematic monitoring, and for core activities involving large-scale special category or criminal data (Article 37); the DPO may be external but must act independently.

Article 28(3) processor contracts must specify subject matter, duration, nature and purpose, data types and data subject categories, instructions, confidentiality, security, sub-processor rules, assistance with rights and DPIAs, deletion or return, and audit.

The lead supervisory authority is that of the controller's or processor's main establishment in the EU (Article 56); the one-stop-shop is coordinated through the consistency mechanism, with EDPB binding decisions under Article 65.

Article 25 requires technical and organisational measures and data minimisation by default, embedded at the design stage; where residual risk remains high after a DPIA, prior consultation with the supervisory authority is required (Article 36).

Article 26 joint controllers must transparently allocate responsibilities, but each remains fully liable to data subjects for the whole processing.

Remedies: complaint to a supervisory authority (Article 77), judicial remedy against an authority (78) or a controller (79), representation by not-for-profit bodies (80), and compensation for material or non-material damage (82).

Compliance tools beyond the core obligations: codes of conduct (Articles 40-41) and certification mechanisms, seals and marks (Articles 42-43) may demonstrate compliance and support transfers.

Article 44 general principle: any transfer of personal data to a third country or international organisation must ensure the GDPR level of protection is not undermined, including for onward transfers.

Article 45 adequacy decisions permit transfers without additional safeguards where the Commission finds essentially equivalent protection; decisions are reviewed at least every four years and may be repealed.

Article 46 appropriate safeguards include standard contractual clauses, binding corporate rules (Article 47), approved codes of conduct and certification with binding and enforceable commitments.

Schrems I (2015) invalidated Safe Harbour; Schrems II (2020) invalidated the Privacy Shield and held SCCs valid only if third-country law does not prevent compliance, assessed case by case.

A transfer impact assessment documents third-country law and practice, especially public authority access and redress, and determines whether supplementary technical, organisational or contractual measures are required.

Article 49 derogations are narrow and mostly limited to occasional, non-repetitive transfers: explicit informed consent, contract necessity, public interest, legal claims, vital interests, and register or public-interest data.

Binding corporate rules are intra-group safeguards approved by the competent supervisory authority through the consistency mechanism; they must be binding and enforceable throughout the group.

The EU-US Data Privacy Framework (2023) is an adequacy decision covering certified US companies that commit to its principles and provide redress mechanisms.

Article 48: a third-country court or authority order is enforceable only on the basis of an international agreement such as a mutual legal assistance treaty, unless a separate transfer ground applies.