CDPO/FR common mistakes
CDPO/FR · Understand the traps and how to avoid them.
Treating the RGPD and the loi Informatique et Libertés as interchangeable, and answering a question about a French-specific mechanism (régime de l'autorisation CNIL, règles locales sur les données de santé, âge de consentement numérique fixé à 15 ans) with the generic RGPD rule.
Candidates study the RGPD first and assume the national law merely copies it. In reality the loi Informatique et Libertés contains derogations and complements (art. 80-84 for health research, art. 45 for CNIL authorisations, art. 8 for minors) that the RGPD explicitly leaves to Member States via opening clauses. The exam tests these articulations.
What to do instead
Build a one-page mapping table of RGPD opening clauses to the corresponding French articles, and for each topic ask 'is this harmonised or national?' before answering. Memorise the French-specific figures (15 years for consent to information society services, 45 days for CNIL breach notification in certain cases, the régime d'autorisation vs déclaration history).
Confusing the responsable de traitement and the sous-traitant when the fact pattern involves a vendor who processes data for its own purposes, or a joint controllership (responsabilité conjointe) situation such as a co-branded marketing campaign or a shared HR platform.
The exam deliberately writes scenarios where a supplier exceeds instructions (becoming a controller for that processing) or where two parties determine purposes jointly. Candidates default to 'the vendor is always a processor', which is a comfortable but wrong heuristic.
What to do instead
Apply the two-part test explicitly: who determines the purposes, and who determines the essential means? If a party pursues its own purpose (e.g. a payroll provider using data for its own analytics), it is a controller for that processing. For joint controllership, cite art. 26 RGPD and the requirement for an arrangement allocating obligations, and remember the person concerned can exercise rights against each controller.
Treating the DPO as personally liable for compliance or as the decision-maker who signs off on processing, and answering governance questions as if the DPO must approve every PIA or every transfer.
The DPO's role is widely misunderstood in practice and candidates import workplace assumptions. The RGPD gives the DPO a monitoring, advising and liaison role (art. 39), while accountability remains with the controller. Candidates also confuse the DPO's independence and reporting line with decision authority.
What to do instead
Memorise art. 37-39 as three blocks: designation criteria (37), position and resources including no instructions and no conflict of interest (38), and missions (39). For any scenario, ask 'who is accountable?' - the controller. The DPO can be consulted, informs and monitors, but does not approve or bear liability. Also remember the DPO must be involved 'duly and in a timely manner' in all data protection matters.
Assuming a valid legal basis under art. 6 automatically permits processing of special categories of data, or that consent is always the required basis for health data, HR data or marketing.
Candidates learn art. 6 bases as a checklist and stop there. Special-category data requires an additional condition under art. 9(2), and in France health data processing often requires a CNIL authorisation or a reference methodology (MR-001 to MR-004) rather than consent. Similarly, marketing to existing customers can rest on legitimate interest under the soft opt-in, not consent.
What to do instead
For every scenario, run a two-step analysis: art. 6 basis AND, if sensitive, art. 9(2) condition, plus any national formality (CNIL authorisation, MR compliance, secrecy obligation for health professionals). Drill the art. 9(2) list with concrete examples (explicit consent, medicine, public health, research with safeguards). For HR, remember consent is rarely freely given in a subordination relationship.
Answering cookie and prospection électronique questions with the RGPD consent standard only, ignoring the ePrivacy directive as transposed in art. L.34-5 CPCE: the requirement for a prior consent banner, the exemption for strictly necessary cookies, and the rules on cookies walls and refusal as easy as acceptance.
The RGPD has become the mental default, but cookies and electronic marketing are governed by the ePrivacy directive and the CPCE, which impose specific constraints (consent before deposit, no pre-ticked boxes, CNIL guidelines of 2020 and the recommandation of 2021 on cookies). Candidates miss the sector-specific layer.
What to do instead
Learn the CPCE/ePrivacy layer separately: art. L.34-5 CPCE for cookies (consent except strictly necessary or audience measurement under conditions), art. L.34-2 for prospection by electronic means (opt-in), and the soft opt-in exception for existing customers on similar products. Memorise the CNIL's practical requirements: refuse button as visible as accept, no cookie walls where a legitimate alternative exists, purpose-by-purpose consent, and easy withdrawal.
Confusing the 72-hour notification deadline to the CNIL with the notification to the persons concerned, and applying the 72 hours to every breach including those unlikely to result in a risk.
Art. 33 and 34 RGPD are studied together and candidates merge them. The 72-hour clock runs from awareness of the breach and applies to notification to the supervisory authority when there is a risk; notification to individuals is required only for a high risk and without a fixed deadline. Candidates also forget the processor's obligation to notify the controller 'without undue delay'.
What to do instead
Draw a decision tree: breach identified → assess risk → if risk, notify CNIL within 72 hours with the art. 33(3) content, documenting reasons for delay if late; if high risk, inform individuals 'without undue delay' with clear language and, where relevant, mitigation advice. Separately note the processor notifies the controller without undue delay, and always keep an internal register of all breaches including non-notified ones.
Treating Standard Contractual Clauses as self-sufficient for a transfer to a third country, without the transfer impact assessment and supplementary measures required after Schrems II, and without distinguishing the 2021 modular SCCs from BCRs and adequacy decisions.
Candidates learn the four transfer tools as a list and pick one, but the exam tests the post-Schrems II reasoning: an adequacy decision is the easiest route, SCCs require a case-by-case assessment of the third country's law and, if needed, supplementary technical, organisational or contractual measures. The 2021 SCCs are modular (four modules) and candidates confuse the modules.
What to do instead
Memorise the hierarchy: adequacy decision (art. 45) → appropriate safeguards (art. 46: SCCs, BCRs, codes, certification) → derogations (art. 49, exceptional). For SCCs, know the four modules (C2C, C2P, P2P, P2C), the docking clause, and the mandatory transfer impact assessment. Practise writing the TIA reasoning: nature of data, third-country law, likelihood of access, supplementary measures, re-evaluation.
Describing the AIPD/PIA as a document to produce rather than a process, and failing to identify when it is mandatory (art. 35: systematic and extensive evaluation, large-scale sensitive data, systematic monitoring of a publicly accessible area) and when prior consultation of the CNIL under art. 36 is required.
Candidates memorise 'AIPD for high-risk processing' but cannot apply the criteria to a scenario, and confuse the AIPD with the registre des activités de traitement or with the CNIL's reference methodologies. They also forget the DPO's advisory role and the possibility of using a code of conduct or certification to demonstrate compliance.
What to do instead
Learn the nine WP29/EDPB criteria for high risk and the CNIL's list of processing requiring an AIPD (including the French list in the délibération of 2018). Structure an answer around: description of processing, necessity and proportionality assessment, risk identification, measures, and residual risk. If residual risk remains high, prior consultation of the CNIL under art. 36. Distinguish AIPD from the registre and from the PIA tooling.
Listing the rights of data subjects as a memorised list without knowing the deadlines, exceptions and modalities: one month extendable by two, the conditions of erasure, the right to object and its absolute character for direct marketing, and the limits of the right of access (e.g. no access to information about third parties, medical data via a professional).
The rights chapter is dense and candidates skim it, so they answer 'the person has the right to X' without the procedural conditions the exam tests. French specifics (indirect access to medical data via a doctor, the CNIL's role in access to public-sector files) are frequently ignored.
What to do instead
Build a table per right: legal basis, deadline (one month, extendable by two for complex requests), exceptions, format, and French particularities. Emphasise that the right to object to direct marketing is absolute and requires no justification, that erasure is not absolute, and that access to health data held by a professional goes through the professional or a designated intermediary. Remember the identity verification requirement and the prohibition on charging a fee except for manifestly unfounded or excessive requests.
Answering audit and accountability questions by naming documents (registre, PIA, charte, code de conduite, certification) without linking them to the accountability principle of art. 5(2) and art. 24, and without distinguishing binding instruments (code de conduite approved under art. 40, certification under art. 42) from voluntary good practice.
The audit/compliance domain is often treated as a vocabulary test. Candidates list artefacts but cannot explain how they demonstrate conformity, who approves them (CNIL or EDPB for codes, accredited bodies for certification), and what their legal effect is (binding and enforceable commitments, not a safe harbour from the RGPD).
What to do instead
Frame every answer around accountability: the controller must be able to demonstrate compliance, and the tools are evidence. Learn the specific regimes: codes de conduite require CNIL approval and EDPB opinion; certification is issued by accredited certification bodies for a maximum of three years and does not shift responsibility from the controller; the registre is an obligation under art. 30 with exemptions for SMEs in limited cases. For audit scenarios, structure around scoping, evidence collection, gap analysis against art. 5 principles and remediation with a risk-based prioritisation.