ICS CDPP cheat sheet

GDPR applies to processing of personal data by controllers/processors in the EU, and to non-EU entities offering goods/services to or monitoring EU data subjects (Art. 3).

UK GDPR mirrors the EU GDPR but is interpreted alongside the Data Protection Act 2018; the ICO is the UK supervisory authority.

GDPR principles (Art. 5): lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, accountability.

Special category data (Art. 9) includes racial/ethnic origin, political opinions, religion, health, sex life, biometric and genetic data; processing needs an Art. 9(2) condition.

Criminal conviction/offence data is handled under Art. 10 and typically requires official authority or specific Member State law.

A controller determines purposes and means of processing; a processor acts on the controller's documented instructions (Art. 4(7)-(8), Art. 28).

Supervisory authority maximum administrative fines: up to EUR 20 million or 4% of global annual turnover, whichever is higher (Art. 83).

Other regimes: CCPA/CPRA (California), LGPD (Brazil), PIPL (China), POPIA (South Africa); each has distinct scope and rights sets.

Six lawful bases (Art. 6(1)): consent, contract, legal obligation, vital interests, public task, legitimate interests.

Legitimate interests requires a three-part test: identify the interest, show necessity, and balance against the data subject's rights and expectations.

Consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action (Art. 4(11), Art. 7).

Purpose limitation: data collected for specified purposes may not be reused incompatibly; compatible reuse is assessed against Art. 6(4) criteria.

Data minimisation: data must be adequate, relevant, and limited to what is necessary for the stated purpose.

Storage limitation: data kept no longer than necessary; retention periods should be defined and documented.

Accuracy principle requires erasure or rectification of inaccurate data without undue delay.

Accountability (Art. 5(2)) requires the controller to demonstrate compliance, not merely claim it.

Rights include access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making (Arts. 15-22).

Right of access must be answered within one month, extendable by two further months for complex requests (Art. 12(3)).

Right to erasure ('right to be forgotten') applies where data is no longer needed, consent is withdrawn, or processing is unlawful (Art. 17).

Data portability applies only to data provided by the data subject, processed by automated means, and based on consent or contract (Art. 20).

Right to object applies to processing based on legitimate interests or public task; for direct marketing, objection is absolute (Art. 21).

Withdrawal of consent must be as easy as giving it; withdrawal does not affect the lawfulness of prior processing (Art. 7(3)).

Requests may be refused or charged only where manifestly unfounded or excessive, with reasons given (Art. 12(5)).

Identity verification is permitted where there are reasonable doubts about the requester's identity (Art. 12(6)).

A Data Protection Officer (DPO) is mandatory for public authorities and for processing requiring large-scale systematic monitoring or special category data (Art. 37).

The DPO must be involved in all data protection matters, report to the highest management level, and must not be dismissed or penalised for performing the role (Art. 38).

Records of Processing Activities (RoPA) are required for controllers with 250+ employees or high-risk processing (Art. 30).

Privacy by design and by default (Art. 25) requires technical and organisational measures embedded at the design stage.

Processor contracts must include the Art. 28(3) mandatory clauses: instructions, confidentiality, security, sub-processors, assistance, deletion, audit.

Joint controllers must transparently allocate responsibilities via an arrangement reflecting their respective roles (Art. 26).

Accountability evidence includes policies, training records, DPIA logs, RoPA, and breach registers.

Codes of conduct (Art. 40) and certification mechanisms (Art. 42) are voluntary tools to demonstrate compliance.

A DPIA is required where processing is likely to result in a high risk to rights and freedoms (Art. 35(1)).

Indicative high-risk triggers include systematic profiling, large-scale special category data, and systematic monitoring of a publicly accessible area (Art. 35(3)).

A DPIA must describe the processing, assess necessity and proportionality, assess risks, and identify mitigation measures (Art. 35(7)).

Where residual high risk remains, the controller must consult the supervisory authority before processing (Art. 36).

Supervisory authorities publish lists of processing operations requiring a DPIA and lists of those not requiring one (Art. 35(4)-(5)).

DPIA should be reviewed when processing changes and revisited periodically; it is not a one-off exercise.

The DPO must be consulted on the DPIA, and the views of data subjects or their representatives should be sought where appropriate (Art. 35(2), 35(9)).

Risk assessment typically scores likelihood and severity of harm to derive an overall risk rating.

A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data (Art. 4(12)).

Controllers must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33(1)).

If notification is not made within 72 hours, it must be accompanied by reasons for the delay (Art. 33(1)).

Notification to the supervisory authority is required unless the breach is unlikely to result in a risk to rights and freedoms.

Data subjects must be notified without undue delay where the breach is likely to result in a high risk (Art. 34).

Breach records must document facts, effects, and remedial action for every breach, whether or not notified (Art. 33(5)).

Processors must notify controllers without undue delay after becoming aware of a breach (Art. 33(2)).

Notification content: nature of breach, DPO contact, likely consequences, and measures taken or proposed (Art. 33(3)).

Transfers outside the EEA require an adequacy decision, appropriate safeguards, or a specific derogation (Art. 44-49).

Adequacy decisions are adopted by the European Commission and may be reviewed, amended, or repealed periodically.

Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs) are recognised appropriate safeguards (Art. 46).

The Schrems II ruling requires a transfer impact assessment and supplementary measures where SCCs are used.

Derogations (Art. 49) include explicit consent, contract necessity, important public interest, legal claims, and vital interests; they are for occasional, non-repetitive transfers.

Onward transfers from a non-EEA recipient require the same level of protection and authorisation from the original exporter.

The EU-US Data Privacy Framework is an adequacy mechanism for certified US organisations.

Transparency obligations require informing data subjects when data is transferred internationally and the safeguards relied upon.