Data Protection and Privacy
This domain tests whether you can classify data, identify the roles in a processing chain, choose a lawful basis, and handle transfers, rights requests and breaches. Questions are scenario-driven: who is the controller, what must happen in what timeframe, and which mechanism legitimizes the flow.
Roles and scope
- Data subject - the individual. Controller - determines purposes and means. Processor - acts on the controller's documented instructions. A processor that starts deciding purposes becomes a controller for that processing.
- Personal data is any information relating to an identified or identifiable person. Pseudonymized data remains personal data (re-identification is possible with additional information); anonymized data falls outside scope only where re-identification is genuinely impossible.
- Special categories (health, biometrics, ethnicity, political opinions, and similar) attract stricter conditions.
Core rules (GDPR-shaped, widely copied)
- Six lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests. Consent must be freely given, specific, informed, unambiguous and withdrawable - it is not the default.
- Principles: lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability.
- A DPIA is required where processing is likely high risk: large-scale special categories, systematic monitoring, profiling with significant effects, new technology.
- Rights: access, rectification, erasure, restriction, portability, objection, and no solely automated decisions with significant effects.
- Breach: notify the supervisory authority within 72 hours of awareness unless unlikely to result in risk; inform affected individuals when risk is high. Processors notify controllers without undue delay.
- Transfers: adequacy decision, or appropriate safeguards (SCCs, BCRs) plus a transfer impact assessment.
Worked example
A retailer's HR team wants biometric time clocks for 4,000 staff. Biometrics are special-category data; processing is large-scale and uses new technology, so a DPIA is mandatory before go-live. Ordinary consent is weak given the power imbalance of employment, so explicit consent or another specific legal ground is needed, plus a necessity assessment and consideration of a less intrusive alternative such as badges. Approval rests with the controller (the employer), not the vendor.
Traps
- Calling pseudonymized data "anonymous" to escape obligations.
- Assuming consent is always required - or always sufficient.
- Quoting 72 hours as the deadline to notify individuals, which has no fixed clock.
- Forgetting the processor's duty to notify the controller rather than the regulator.
- Ignoring retention: "keep forever in case" fails storage limitation.