Data Protection Law and Regulatory Frameworks
What to know
A privacy professional must distinguish instruments (statutes, regulations, directives, guidance) from regulators (supervisory authorities) and from standards (ISO, NIST) that are not law. Know the difference between a regulation (directly applicable in all member states) and a directive (requires national implementing law). Understand the roles of controller, processor, joint controllers, and the concept of supervisory authority with powers of investigation, correction, and sanction. Be able to place sectoral overlays (health, financial, telecoms, employment) alongside general law, and know that national derogations may narrow or expand general rules.
Traps
Questions often test who is the regulator versus who issues guidance; extraterritorial reach; whether a document is binding or advisory; and the distinction between lawful basis (a legal test) and regulatory permission (an authorisation). Another trap: assuming a directive applies directly, or that a standard confers legal compliance by itself. Watch for questions that conflate data protection with data security or freedom of information.
Worked example
A company outside the EU offers goods to EU residents and monitors their behaviour. Rule of thumb: targeting + monitoring = territorial scope, regardless of where processing occurs. If the entity is not established in the jurisdiction, it typically must designate a local representative. Contrast: an entity merely accessible online to foreign users, without targeting, usually falls outside scope.
Rule of thumb
Ask three questions: Is it law, guidance, or standard? Who enforces it? Does it reach this entity's activity?