ICS CDPP flashcards
ICS CDPP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- GDPR material scope
- Applies to processing of personal data wholly or partly by automated means, and to non-automated processing of data forming part of a filing system.
- GDPR territorial scope
- Covers EU-established controllers/processors and non-EU entities offering goods or services to, or monitoring, EU data subjects.
- Controller definition
- Natural or legal person, public authority, agency, or body which alone or jointly determines the purposes and means of processing personal data.
- Processor definition
- Natural or legal person, public authority, agency, or body which processes personal data on behalf of the controller.
- Special category data
- Data revealing racial or ethnic origin, political opinions, religious beliefs, health, sex life, sexual orientation, genetic and biometric data.
- Maximum administrative fine
- Up to EUR 20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.
- Six lawful bases
- Consent, contract, legal obligation, vital interests, public task, and legitimate interests, as listed in Article 6(1).
- Purpose limitation principle
- Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in an incompatible manner.
- Data minimisation principle
- Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
- Legitimate interests test
- A three-part assessment: identify the legitimate interest, show processing is necessary, and balance against the data subject's rights.
- Valid consent criteria
- Consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action by the data subject.
- Storage limitation principle
- Personal data must be kept in a form permitting identification of data subjects for no longer than necessary for the processing purpose.
- Right of access
- Data subjects may obtain confirmation of processing, a copy of their personal data, and information about purposes, recipients, and retention.
- Response deadline for requests
- Controllers must respond to data subject requests within one month, extendable by two further months for complex or numerous requests.
- Right to erasure
- Data subjects may request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful, subject to exceptions.
- Data portability scope
- Applies to data provided by the data subject, processed by automated means, and based on consent or contract, delivered in a structured format.
- Absolute right to object
- Where personal data is processed for direct marketing purposes, the data subject may object at any time and processing must stop.
- Withdrawal of consent
- Withdrawal must be as easy as giving consent and does not affect the lawfulness of processing carried out before withdrawal.
- Data Protection Officer trigger
- A DPO is mandatory for public authorities, large-scale systematic monitoring, or large-scale processing of special category or criminal data.
- Records of Processing Activities
- Controllers must maintain a record of processing activities containing purposes, categories, recipients, transfers, and retention periods.
- Privacy by design
- Technical and organisational measures must be implemented at the design stage and by default to protect data and minimise processing.
- Processor contract clauses
- Article 28(3) requires instructions, confidentiality, security, sub-processor rules, assistance duties, deletion, and audit rights in processor contracts.
- Joint controllers
- Two or more controllers jointly determining purposes and means must transparently allocate responsibilities via an arrangement reflecting their roles.
- DPIA mandatory trigger
- A DPIA is required where a type of processing is likely to result in a high risk to the rights and freedoms of individuals.
- DPIA required content
- A DPIA must describe processing, assess necessity and proportionality, assess risks, and set out measures to address those risks.
- Prior consultation trigger
- Where a DPIA indicates residual high risk not mitigated by measures, the controller must consult the supervisory authority before processing.
- High-risk processing indicators
- Systematic profiling, large-scale special category processing, and systematic monitoring of publicly accessible areas are indicative high-risk triggers.
- 72-hour breach notification
- Controllers must notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware of a breach.
- Breach notification to data subjects
- Where a breach is likely to result in high risk, the controller must communicate it to affected data subjects without undue delay.
- Breach record obligation
- Controllers must document all breaches, including facts, effects, and remedial action, whether or not notification to the authority is required.
- Processor breach duty
- A processor must notify the controller without undue delay after becoming aware of a personal data breach affecting data it processes.
- Transfer impact assessment
- An assessment of third-country law and practice and supplementary measures needed to protect data transferred under standard contractual clauses.