EXIN PDPP cheat sheet

Personal data = any information relating to an identified or identifiable natural person; identifiability can be direct (name, ID number) or indirect (IP address, location data, device identifiers combined with other data).

Special categories of data (GDPR Art. 9) include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation.

Processing means any operation performed on personal data: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure or destruction.

Core privacy principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

Data subject rights under GDPR: access, rectification, erasure, restriction, data portability, objection, and rights relating to automated decision-making including profiling.

Controller determines purposes and means of processing; processor acts on the controller's behalf. Joint controllers share determination of purposes and means and are jointly liable.

Anonymisation removes all reasonable means of re-identification; pseudonymisation keeps data linkable to a separate key, so pseudonymised data remains personal data.

Consent must be freely given, specific, informed and unambiguous, expressed by a statement or clear affirmative action; silence, pre-ticked boxes or inactivity do not constitute consent.

Privacy by design and by default (GDPR Art. 25): data protection measures are built into processing from the outset, and only data necessary for each specific purpose is processed by default.

GDPR applies to processing by an EU/EEA controller or processor establishment, and extraterritorially to non-EU entities that offer goods or services to, or monitor the behaviour of, data subjects in the EU.

Lawful bases under GDPR Art. 6: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests (the last not available to public authorities for their public tasks).

GDPR fines: up to EUR 10 million or 2% of total worldwide annual turnover (whichever higher) for certain obligations; up to EUR 20 million or 4% for breaches of core principles, lawful basis, and data subject rights.

The EU-US Data Privacy Framework, Standard Contractual Clauses, and Binding Corporate Rules are recognised transfer mechanisms for moving personal data outside the EEA.

The ePrivacy Directive governs cookies, electronic marketing and confidentiality of communications; it sits alongside the GDPR and requires consent for non-essential cookies.

The NIS2 Directive imposes cybersecurity risk-management and incident-reporting duties on essential and important entities across sectors such as energy, health, transport and digital infrastructure.

The EU AI Act uses a risk-based tiering: prohibited practices, high-risk systems with conformity assessment, limited-risk transparency duties, and minimal-risk systems.

The Council of Europe Convention 108+ is the only binding international treaty on data protection and modernises Convention 108 for the digital age.

National supervisory authorities enforce the GDPR; the one-stop-shop mechanism lets a lead authority handle cross-border processing where the controller has its main establishment in that member state.

A DPIA is required where processing is likely to result in a high risk to rights and freedoms, notably systematic and extensive profiling, large-scale special-category or criminal data, or systematic large-scale monitoring of a publicly accessible area.

Data breach notification: notify the supervisory authority without undue delay and where feasible within 72 hours of awareness, unless the breach is unlikely to result in a risk; notify affected data subjects without undue delay where there is a high risk.

The record of processing activities (GDPR Art. 30) must describe purposes, categories of data subjects and data, recipients, third-country transfers, retention periods and security measures.

Data protection by design techniques include pseudonymisation, encryption, access controls, minimisation at collection, and automated retention deletion.

A valid cookie consent banner offers accept and reject with equal prominence, no pre-ticked categories, granular per-purpose choices, and no consent walls for non-essential cookies where refusal is not genuinely possible.

Data subject access requests must be answered without undue delay and within one month, extendable by two further months for complex requests; the controller may charge a fee only for manifestly unfounded or excessive requests.

A processor agreement (GDPR Art. 28) must cover subject matter, duration, nature and purpose, types of data, obligations and rights, plus confidentiality, security, sub-processor rules, assistance duties, deletion or return, and audit rights.

Transfer impact assessments evaluate the laws of the destination country and whether supplementary technical, organisational or contractual measures are needed.

Privacy risk assessment scores likelihood and severity of harm to individuals, distinct from organisational security risk that focuses on business impact.

Accountability requires the controller to demonstrate compliance, not merely comply: policies, records, DPIAs, training logs and audit trails serve as evidence.

A Data Protection Officer is mandatory where processing is carried out by a public authority, involves large-scale regular and systematic monitoring, or involves large-scale special-category or criminal data; the DPO reports to the highest management level and must be independent.

The DPO's tasks include informing and advising, monitoring compliance, advising on DPIAs, cooperating with the supervisory authority, and acting as contact point; the DPO may not be dismissed or penalised for performing the role.

A privacy programme typically rests on a governance layer (policy, roles, DPO), an operational layer (records, DPIAs, consent, breach handling) and an assurance layer (audits, metrics, training effectiveness).

Privacy metrics should be outcome-based: percentage of processing activities covered by a DPIA, breach notification timeliness, DSAR response time, and third-party assessment coverage.

Vendor management requires due diligence before onboarding, contractual data protection terms, periodic reassessment, and a register of processors and sub-processors.

Training must be role-based: developers need privacy-by-design guidance, marketing needs consent and e-marketing rules, HR needs employee-data specifics; completion rates alone do not evidence competence.

A compliance framework maps obligations to controls and owners, with review triggers when law changes, new processing starts, or a breach reveals a control gap.

Supervisory authority cooperation includes prior consultation for high-risk residual processing and maintaining a single point of contact for cross-border matters.