I85PREP
⌘ K
CWIDP study materials
CWIDP study resources

CWIDP: Privacy, Ethics, and Regulatory Compliance: purpose, basis, rights

CWIDP · Work through your exam, one topic at a time.

All guide sections

Privacy, Ethics, and Regulatory Compliance: purpose, basis, rights

What this domain tests

Privacy, Ethics, and Regulatory Compliance tests whether you can justify collecting and using data, limit it to what is necessary, and honor individual rights. Expect GDPR principles, lawful bases, consent, data subject rights, CCPA/CPRA, retention, anonymization, and ethics review.

Core rules

  • Start with purpose limitation and data minimization: define the purpose, collect only the fields needed, and set a retention period.
  • Every processing activity needs a lawful basis under GDPR: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Legitimate interests requires a documented balancing test.
  • Consent must be freely given, specific, informed, and withdrawable; pre-ticked boxes and bundled consent fail.
  • Publicly accessible data is not automatically free to process. It still needs a lawful basis, transparency, and a necessity assessment.
  • Honor data subject rights: access, rectification, erasure, restriction, portability, and objection within statutory deadlines (generally one month under GDPR).
  • Pseudonymization reduces risk but is not anonymization; hashed identifiers can still be personal data when re-identification is possible.
  • Run a DPIA for high-risk processing such as large-scale profiling or systematic monitoring.
  • Under CCPA/CPRA, respect notice at collection, opt-out of sale/share, and global privacy signals where applicable.

Worked example

You plan to scrape public professional profiles to build a sales-intent model. Reasoning: the profiles are public, but that does not create a lawful basis. You document legitimate interests, run a balancing test against users' reasonable expectations, minimize to role, company, and public skills, exclude special-category data, set a 12-month retention period, provide a privacy notice and objection route, and assess whether the scale triggers a DPIA. You record the decision and review it. If the model profiles individuals in the EU, you also assess automated decision-making rules under GDPR Article 22.

Traps that cost marks

  • Assuming public data is exempt from privacy law.
  • Treating a hash or token as anonymization.
  • Bundling consent for unrelated purposes.
  • Keeping data indefinitely because deletion is inconvenient.
  • Ignoring cross-border transfer mechanisms when data leaves the region.