ICDL Data Protection (ICDL) cheat sheet

Personal data is any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified directly or indirectly, e.g. by an identifier such as a name, ID number, location data, or online identifier.

Processing means any operation performed on personal data, whether automated or not: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

A data controller determines the purposes and means of processing; a data processor processes personal data on the controller's behalf; the controller bears primary legal responsibility for compliance.

Special category data (sensitive data) includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation.

The data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability.

Purpose limitation means personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

Data minimisation requires personal data to be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

Consent must be freely given, specific, informed and unambiguous, expressed by a statement or clear affirmative action; silence, pre-ticked boxes or inactivity do not constitute consent.

Pseudonymisation replaces identifying attributes with artificial identifiers so data can no longer be attributed to a person without additional information kept separately; it reduces risk but the data remains personal data.

A lawful basis must be identified before processing: consent, contract performance, legal obligation, vital interests, public task, or legitimate interests; special category data additionally requires an Article 9-type condition.

Privacy by design and by default: data protection measures are built into processing systems, and by default only personal data necessary for each specific purpose is processed.

A data protection impact assessment (DPIA) is required where processing is likely to result in a high risk to individuals, notably for large-scale systematic monitoring or large-scale processing of special category data.

Data processors must be bound by a written contract that specifies subject matter, duration, nature and purpose of processing, the types of personal data, categories of data subjects, and the controller's and processor's obligations.

A record of processing activities (ROPA) typically lists the purposes of processing, categories of data subjects and personal data, recipients, transfers to third countries, retention periods, and security measures.

Data protection by design applies at the point of determining the means of processing and at the time of the processing itself; it is a continuing obligation, not a one-off step.

Transfers of personal data outside the jurisdiction require a transfer mechanism such as an adequacy decision, standard contractual clauses, or binding corporate rules.

The storage limitation principle requires retention periods to be defined and data deleted or anonymised once the purpose is fulfilled, unless a legal retention obligation applies.

Anonymisation irreversibly removes identifiability so the data falls outside data protection law; pseudonymisation does not, because re-identification remains possible with separately held keys.

A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Breach notification to the supervisory authority is generally required without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals.

Notification to affected data subjects is required without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

The 72-hour clock starts when the controller becomes aware of the breach, not when the breach occurred; a processor must notify the controller without undue delay after becoming aware.

A breach record must be maintained for all breaches, including those not notified, documenting the facts, effects, and remedial action taken.

Appropriate technical and organisational measures include encryption, pseudonymisation, access controls, regular testing of security measures, and staff confidentiality obligations.

The confidentiality, integrity and availability (CIA) triad frames security: confidentiality prevents unauthorised disclosure, integrity prevents unauthorised alteration, and availability ensures timely access to data.

A processor must assist the controller in ensuring compliance with breach notification and security obligations, and must not engage another processor without prior authorisation.

Data subjects have the right of access to their personal data and to information such as processing purposes, categories of data, recipients, retention periods, and the existence of automated decision-making.

The right to rectification allows data subjects to have inaccurate personal data corrected and incomplete data completed without undue delay.

The right to erasure ('right to be forgotten') applies, among other grounds, where data is no longer necessary, consent is withdrawn and no other basis applies, or processing is unlawful; it is not absolute.

The right to data portability allows a data subject to receive data they provided in a structured, commonly used, machine-readable format and to transmit it to another controller where processing is based on consent or contract and is automated.

The right to object allows a data subject to object to processing based on legitimate interests or public task; where processing is for direct marketing, the objection is absolute and processing must stop.

The right to restriction of processing limits the controller to storage only while accuracy, lawfulness, or the controller's legitimate grounds are being verified.

Data subject requests must generally be answered without undue delay and within one month, extendable by up to two further months for complex or numerous requests, with the data subject informed of the extension.

The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects applies unless necessary for a contract, authorised by law, or based on explicit consent.

The accountability principle requires the controller to demonstrate compliance, e.g. through policies, records of processing, DPIAs, and appointment of a data protection officer where required.