Privacy and Data Protection Fundamentals
Domain 1: Privacy and Data Protection Fundamentals
This domain tests the vocabulary and first principles the rest of the exam assumes: what personal data is, when processing occurs, who is accountable for it, and which principles govern every processing operation. Expect definitional precision rather than policy opinion.
Core definitions
- Personal data: any information relating to an identified or identifiable natural person. Identifiability can be direct (name) or indirect (IP address, cookie ID, employee number) and is assessed against means reasonably likely to be used.
- Processing: any operation performed on personal data, from collection and storage to analysis, disclosure, and erasure. Almost every business action involving data is processing.
- Controller: determines the purposes and means of processing. Processor: processes on the controller’s behalf and follows instructions.
The Article 5 principles
Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. These are not slogans: each processing activity must satisfy all applicable principles, and the controller must be able to demonstrate compliance.
Pseudonymisation and anonymisation
Pseudonymised data can be attributed to a person with additional information kept separately, so it remains personal data and stays in scope. Anonymisation must be irreversible; if re-identification is reasonably likely, the data is still personal.
Worked example
A retailer sends marketing emails and tracks open rates using a unique link per recipient. The email address and link ID relate to an identifiable person, so both are personal data. The retailer decides why and how to process them, so it is the controller. The email provider that sends on its behalf is a processor. The retailer needs a lawful basis (consent or legitimate interests, depending on facts), must apply purpose limitation (marketing only), and must inform recipients transparently. Pseudonymising the link ID does not remove GDPR obligations because the retailer holds the key.
Mark-losing traps
- Treating privacy and data protection as identical. Privacy is broader; data protection is the legal regime for personal data.
- Assuming pseudonymised data is anonymous.
- Calling any vendor a processor when it determines its own purposes.
- Choosing legitimate interests by default without a balancing test.
- Forgetting that principles apply at collection and throughout the lifecycle.