Data Protection Principles and Lawful Processing
The Principles and Lawful Processing domain tests whether you can apply Article 5-style principles to a processing activity and select a defensible lawful basis. Questions typically present a business initiative and ask which principle is at risk, which basis fits, or whether a DPIA is required.
Core rules
- GDPR Article 5: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. These are enforceable duties, not slogans.
- Lawful bases (Article 6): consent; contract; legal obligation; vital interests; public task; legitimate interests. Special category data needs an Article 9 condition on top.
- Legitimate interests requires a three-part assessment: a genuine, legitimate interest; necessity of the processing; and a balancing test against individuals' rights and reasonable expectations, with mitigating safeguards.
- Necessity and proportionality are assessed against the stated purpose, so "it might be useful later" fails purpose limitation.
- Accountability (Articles 5(2), 24) requires records of processing (Article 30), a DPIA for high-risk processing (Article 35), and data protection by design and by default (Article 25).
- Transparency (Articles 12–14) requires concise, intelligible notice at the point of collection covering purposes, bases, recipients, retention and rights.
Worked example
An employer wants to scan all employee email for keywords suggesting leaks. Legitimate interests is the plausible basis, but the test fails at necessity: less intrusive measures - restricting forwarding of customer lists, alerting on bulk downloads from the CRM - achieve the same aim. Blanket content scanning also fails the balancing test given employees' reasonable expectations and the availability of targeted monitoring. A DPIA would be required, and works council consultation may apply.
Traps that cost marks
- Relying on legitimate interests for public authorities performing a public task, or for unnecessary processing.
- Confusing purpose limitation (use only for stated purposes) with minimisation (collect only what is needed).
- Treating a privacy notice as consent, or bundling consent into terms and conditions.
- Forgetting that consent must be easy to withdraw and that withdrawal is not retroactive.
- Skipping a DPIA because the project is "internal"; internal high-risk processing still triggers Article 35.