ICDL Data Protection (ICDL) cheat sheet

Personal data is any information relating to an identified or identifiable natural person; identifiability can be direct (name) or indirect (ID number, location, online identifier).

A data subject is the natural person whose personal data is processed; a controller determines the purposes and means of processing; a processor acts on the controller's behalf.

Special categories of personal data (e.g., health, biometrics for unique identification, racial or ethnic origin, religious beliefs, sexual orientation) require a higher legal threshold to process.

Pseudonymisation reduces linkability by replacing identifiers with keys held separately; it lowers risk but the data remains personal data.

Anonymisation irreversibly removes identifiability; anonymised data falls outside data protection law, but the standard for irreversibility is high.

Consent must be freely given, specific, informed, and unambiguous; it can be withdrawn at any time and withdrawal must be as easy as giving it.

Processing means any operation on personal data, including collection, recording, storage, alteration, retrieval, disclosure, and erasure.

A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data.

Lawful processing requires at least one legal basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests.

Legitimate interests requires a three-part test: a legitimate interest, processing necessary for that interest, and a balancing against the data subject's rights and expectations.

Purpose limitation: data collected for one purpose may not be reused for an incompatible purpose without a new legal basis or compatibility assessment.

Data minimisation: only data adequate, relevant, and limited to what is necessary for the stated purpose may be processed.

Storage limitation: data must be kept no longer than necessary; retention periods should be defined and documented.

Accuracy principle: inaccurate personal data must be rectified or erased without undue delay, taking reasonable steps to ensure accuracy.

Accountability: the controller must be able to demonstrate compliance, typically through records of processing activities, policies, and risk assessments.

A data protection impact assessment is required where processing is likely to result in a high risk, such as large-scale special category data or systematic monitoring.

Right of access: the data subject may obtain confirmation of processing, a copy of the personal data, and information about purposes, recipients, and retention.

Right to rectification: inaccurate data must be corrected and incomplete data completed without undue delay.

Right to erasure (right to be forgotten) applies where data is no longer necessary, consent is withdrawn, or processing was unlawful; it is not absolute.

Right to restriction of processing limits the controller to storage only while accuracy or lawfulness is being verified.

Right to data portability applies to data provided by the data subject and processed by automated means on the basis of consent or contract; it is delivered in a structured, machine-readable format.

Right to object applies to processing based on legitimate interests or public task; for direct marketing the objection is absolute.

Rights relating to automated decision-making include safeguards such as human intervention and the ability to contest a decision based solely on automated processing with significant effects.

Controllers must respond to rights requests within the statutory period (typically one month, extendable by two months for complex requests) and generally free of charge.

Privacy by design and by default: data protection measures are built into systems and the most privacy-protective settings apply unless changed.

Data protection officers advise on compliance, monitor processing, and act as contact point for supervisory authorities; independence is required.

Records of processing activities should capture purposes, categories of data and data subjects, recipients, retention periods, and security measures.

Security safeguards include encryption, access control, regular testing, and the ability to restore availability after an incident.

Breach notification to the supervisory authority is generally required within 72 hours of becoming aware where risk to rights and freedoms exists.

Notification to affected data subjects is required where a breach is likely to result in a high risk to their rights and freedoms.

A processor must be bound by a written contract covering processing instructions, confidentiality, security, sub-processor rules, and assistance with data subject rights.

Transfers of personal data to third countries require an adequacy decision, appropriate safeguards, or a specific derogation.