Privacy and Data Protection in Practice
Domain 3: Privacy and Data Protection in Practice
This domain tests operational execution: impact assessments, records of processing, breach handling, the DPO role, privacy by design, and vendor management. Questions often ask what must happen, in what order, and who must act.
Core operational duties
- DPIA: required where processing is likely to result in a high risk to rights and freedoms, especially systematic monitoring, large-scale special category data, or new technology. It must describe the processing, assess necessity and proportionality, identify risks, and set out mitigations. If residual risk remains high, the controller must consult the supervisory authority before processing.
- Records of processing (ROPA): controllers and processors must maintain records, with limited exemptions; the “only large companies” belief is wrong.
- Breach notification: the controller notifies the supervisory authority within 72 hours of awareness unless the breach is unlikely to result in a risk. Affected individuals are notified without undue delay where there is a high risk. Processors notify controllers without undue delay.
- DPO: mandatory for public authorities, large-scale systematic monitoring, or large-scale special category processing. The DPO monitors compliance, advises, and cooperates with the authority, and must be independent.
- Privacy by design and by default: embed protections into systems and ensure only necessary data is processed by default.
Worked example
An employer introduces always-on GPS tracking in company vehicles plus biometric clock-in. The processing involves systematic monitoring, biometric data used for unique identification, and likely new technology, so a DPIA is required. The DPIA must assess necessity and proportionality, consider less intrusive alternatives, identify risks to employees, and define measures such as geofencing and retention limits. The DPO should advise and monitor the DPIA. If residual risk remains high, the employer must consult the supervisory authority before going live.
Mark-losing traps
- Treating the DPIA as a one-off IT document rather than a decision-support process.
- Sending breach notifications to individuals within 72 hours instead of to the authority.
- Expecting a processor to notify the supervisory authority directly.
- Assuming a DPO is always mandatory.
- Believing ROPA only applies to organisations with 250+ employees.