Legal and Regulatory Framework
Domain 2: Legal and Regulatory Framework
This domain tests how the GDPR and related law apply in practice: territorial scope, lawful bases, special categories, data subject rights, international transfers, and enforcement. The exam favours scenario questions where you must identify the applicable rule and the responsible actor.
Scope and lawful bases
- Territorial scope (Article 3): the GDPR applies to processing by an EU/EEA establishment, and to non-EU controllers or processors that offer goods or services to people in the EU or monitor their behaviour.
- Lawful bases (Article 6): consent, contract, legal obligation, vital interests, public task, and legitimate interests. Each processing purpose needs a basis; consent must be freely given, specific, informed, and unambiguous.
- Special categories (Article 9): data revealing racial or ethnic origin, political opinions, religion, trade union membership, genetic or biometric data for unique identification, health, sex life, or sexual orientation needs a separate Article 9 condition.
- Rights: access, rectification, erasure, restriction, portability, objection, and automated decision-making safeguards.
Transfers and enforcement
Transfers outside the EEA need an adequacy decision, appropriate safeguards such as standard contractual clauses, or a specific derogation. Supervisory authorities enforce the GDPR; cross-border cases use the one-stop-shop, and fines can reach €20 million or 4% of global annual turnover, whichever is higher. Sector rules such as the ePrivacy Directive add consent requirements for cookies and electronic marketing.
Worked example
A Canadian software company has no EU office but offers a free trial to EU users and monitors their in-app behaviour for analytics. Article 3(2) applies because it offers a service to EU users and monitors behaviour. It must provide Article 13 information, identify a lawful basis, honour data subject rights, and appoint an Article 27 representative in the EU. If it sends data to Canada, it can rely on the EU adequacy decision for Canada; if data goes elsewhere without adequacy, it needs SCCs or another valid transfer tool.
Mark-losing traps
- Assuming the GDPR only applies to companies established in the EU.
- Treating consent as always required; other lawful bases may fit better.
- Missing that biometric data used for unique identification is a special category.
- Confusing adequacy decisions with SCCs.
- Ignoring ePrivacy consent rules for cookies and marketing.