Data Protection in Practice
From principles to everyday operations
This domain tests whether you can apply concepts to realistic workplace scenarios: collecting, storing, sharing, and retaining data. Expect questions framed as "what should the organisation do?" rather than definitions.
Privacy by design and by default. Data protection should be built into systems and processes from the start, and the default settings should be the most protective (e.g., minimum collection, short retention, restricted visibility). Trap: candidates pick "add a privacy notice at the end" - that is an afterthought, not by design.
Data protection impact assessments (DPIAs). Required for processing likely to result in high risk - large-scale special-category data, systematic monitoring, profiling, new technologies. A DPIA identifies risks and mitigations before processing begins. Trap: a DPIA is not a one-off form for every project; it is triggered by high risk.
Minimisation and retention in practice. Collect only fields you use; delete or anonymise when the purpose ends. Retention schedules should be documented, not ad hoc. Trap: "keep everything in case it's useful" violates storage limitation and minimisation.
Sharing. Sharing with a processor needs a written contract with instructions and confidentiality. Transfers to third parties need a lawful basis and transparency. Trap: internal sharing is not automatically "safe" - employees should access only what their role requires (need-to-know).
Special categories (e.g., health, biometrics, ethnicity, religion) need extra protection and usually a specific condition beyond an ordinary lawful basis.
Rule of thumb: for any scenario, run the checklist - lawful basis? minimum data? accurate? kept only as long as needed? secured? shared only with the right people under the right terms?
Worked example: A marketing team wants to email a purchased list. Correct analysis: no valid consent from those individuals, purpose differs from collection, and no transparency - this fails lawfulness, purpose limitation and transparency. The fix is a lawful basis and a compliant notice, not a longer unsubscribe link.