Data Protection Concepts
The vocabulary questions hinge on
Data protection law is built on a small set of defined roles and principles, and most exam items test whether you can assign a fact pattern to the right role or principle. Learn these precisely.
Personal data is any information relating to an identified or identifiable natural person. The trap: candidates assume data must be a name or address. It need not be - an identification number, location data, or an online identifier can be personal data if it can be linked to a person, directly or indirectly. Anonymous data (no re-identification possible) sits outside the regime; pseudonymised data (linked via a key) does not.
Roles. The data subject is the individual. The controller determines the purposes and means of processing - the decision-maker. The processor processes on the controller's behalf and follows instructions. Trap: a vendor that decides why data is used becomes a controller even if a contract calls it a processor. Labels in contracts do not override facts.
Principles. Lawfulness, fairness and transparency; purpose limitation (collect for specified, explicit, legitimate purposes, not reuse incompatibly); data minimisation (adequate, relevant, limited to what is necessary); accuracy; storage limitation; integrity and confidentiality; accountability (you must be able to demonstrate compliance).
Lawful bases typically include consent, contract, legal obligation, vital interests, public task, and legitimate interests. Trap: consent must be freely given, specific, informed, unambiguous, and withdrawable - pre-ticked boxes or bundled consent fail.
Rule of thumb: ask three questions in order - Is it personal data? Who decides the purpose (controller) or only follows instructions (processor)? Which principle or lawful basis does the fact pattern name? Answer those and most concept questions resolve.
Worked example: A payroll bureau processes salary data for a client firm using the firm's instructions. Firm = controller; bureau = processor; employees = data subjects. If the bureau starts using the data to sell its own services, it becomes a controller for that activity.