Compliance with European Data Protection Law and Regulation
Turning obligations into operations
Compliance questions test whether you can match a fact pattern to a mechanism and a deadline. Core mechanisms: records of processing under Article 30 (written or electronic, containing the listed elements); data protection impact assessment under Article 35 where processing is likely to result in high risk, with prior consultation under Article 36 if residual risk stays high; data protection by design and by default under Article 25; written processor contracts under Article 28 with its mandatory terms; joint controller arrangements under Article 26; demonstrable consent under Article 7; and transparency notices under Articles 13–14. Governance adds the DPO (Article 37: mandatory for public authorities, large-scale regular and systematic monitoring, and large-scale special category or criminal data processing; independent, reporting to the highest management level), codes of conduct (Article 40), certification (Article 42) and certification bodies (Article 43).
Deadlines and traps
Data subject requests: one month, extendable by two further months for complexity. Breach notification: 72 hours to the supervisory authority after becoming aware, and to data subjects without undue delay only where high risk. A DPIA is not a one-off document and is not needed for every processing operation. The DPO bears no personal liability, may be external, and need not be an EU resident. The small-organisation exemption from record-keeping does not apply to regular processing, special category data or criminal data.
Rule of thumb
For any scenario ask four questions in order: what is the role (controller, joint controller, processor)? which Article 6 basis and, if needed, Article 9 condition? what documentation or assessment is triggered? what is the deadline?