ICS ECDPO cheat sheet

Seven core principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

Personal data is any information relating to an identified or identifiable natural person; identifiability includes direct and indirect means such as identifiers, location data, or online identifiers.

Special category data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric for ID, health, sex life or sexual orientation) requires an Article 9 condition in addition to a lawful basis.

Criminal conviction and offence data is handled under a separate regime requiring official authority or specific legal authorisation.

Purpose limitation means data collected for specified, explicit, legitimate purposes must not be further processed in an incompatible way; compatibility considers link to original purpose, context, nature, and consequences.

Storage limitation requires deletion or anonymisation when the purpose is fulfilled; pseudonymised data remains personal data, anonymised data falls outside the regime.

The data protection regime is principle-based, not rule-based: principles apply regardless of technology, format, or processing medium.

Accountability requires the controller to demonstrate compliance, not merely comply; evidence includes policies, records, DPIAs, and training logs.

Six lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests; the basis must be selected before processing begins and cannot be retrofitted.

Legitimate interests requires a three-part test: a legitimate interest, necessity of processing, and a balancing exercise against the individual's rights and expectations.

Valid consent requires a freely given, specific, informed, and unambiguous indication of wishes by statement or clear affirmative action; silence, pre-ticked boxes, and inactivity do not constitute consent.

Consent must be as easy to withdraw as to give, and withdrawal must be actioned without detriment and without delay.

Where consent is the basis, the individual may withdraw at any time; where another basis applies, withdrawal of consent is not the applicable right.

Consent for children in online services: where information society services are offered directly to a child, consent thresholds vary by jurisdiction (commonly 13-16).

Controllers relying on consent must maintain records of consent, including who consented, when, what they were told, and how they consented.

Legitimate interests and consent are mutually exclusive for the same processing activity; a controller cannot swap between them at will.

Core rights: information, access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making.

Standard response deadline is one month from receipt; extension of two further months is permitted for complex or numerous requests, with notification to the requester within the first month.

Identity verification may be requested where there are reasonable doubts; the clock generally runs from receipt, and verification time is not automatically excluded.

Access requests must be fulfilled free of charge; a reasonable fee or refusal may apply where requests are manifestly unfounded or excessive.

Erasure (right to be forgotten) applies where data is no longer necessary, consent is withdrawn, objection succeeds, or processing was unlawful, subject to exemptions such as legal obligation or legal claims.

Restriction requires the controller to store but not otherwise process the data, typically pending accuracy verification or objection assessment.

Portability applies only to data provided by the individual, processed by automated means, and based on consent or contract.

Objection to direct marketing is absolute and must be actioned immediately; objection to other legitimate-interests processing requires a compelling-override assessment.

A DPIA is required where processing is likely to result in a high risk to individuals' rights and freedoms, particularly for new technologies or large-scale processing.

Common DPIA triggers: systematic and extensive profiling with significant effects, large-scale special category data, and systematic monitoring of a publicly accessible area.

A DPIA must describe the processing, assess necessity and proportionality, identify and assess risks, and set out measures to address those risks.

Where a DPIA indicates a high residual risk that cannot be mitigated, the controller must consult the supervisory authority prior to processing.

Risk is assessed from the perspective of the individual, combining likelihood and severity of harm, not solely organisational or commercial impact.

DPIAs should be reviewed and updated when processing changes or new risks emerge, and should be conducted before processing begins.

Prior consultation requires submission of the DPIA, details of controller and processors, purposes, and any measures and safeguards proposed.

Risk treatment options include avoidance, reduction (technical and organisational measures), transfer (e.g., insurance), and acceptance with documented rationale.

A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Notification to the supervisory authority is required within 72 hours of becoming aware where the breach is likely to result in a risk to rights and freedoms.

Notification to affected individuals is required without undue delay where the breach is likely to result in a high risk, communicated in clear and plain language.

Controllers must maintain an internal breach register recording all breaches, including those not notifiable, with facts, effects, and remedial action.

Processors must notify the controller without undue delay upon becoming aware of a breach; the controller retains the notification obligation.

Appropriate technical and organisational measures include encryption, pseudonymisation, access control, resilience, and regular testing of security measures.

Breach risk assessment considers data type and sensitivity, volume, identifiability, likelihood of misuse, and ease of identification of affected individuals.

Incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Accountability requires demonstrable compliance through policies, records of processing activities, DPIAs, breach logs, and training records.

Records of processing activities must be maintained by controllers and processors, covering purposes, categories, recipients, transfers, and retention periods.

A Data Protection Officer is required for public authorities, large-scale systematic monitoring, or large-scale special category processing; the DPO must be independent and report to the highest management level.

Data protection by design and by default requires embedding protections into processing and ensuring only necessary data is processed by default.

Privacy management programmes typically follow a plan-do-check-act cycle: policy setting, implementation, monitoring and audit, and corrective action.

Training programmes should be role-based, risk-based, recurring, and evidenced with completion records and assessment results.

Data protection audits should be independent, risk-based, documented, and tracked to closure with management ownership of remediation.

Governance documentation includes retention schedules, data classification schemes, processor registers, and transfer impact assessments.

A restricted transfer occurs when personal data is sent to, or accessed from, a country or organisation outside the originating jurisdiction without adequacy protection.

Transfer mechanisms include adequacy decisions, standard contractual clauses, binding corporate rules, and specific derogations.

A transfer impact assessment evaluates the laws and practices of the destination country and identifies supplementary measures where protection is insufficient.

Derogations (explicit consent, contract necessity, public interest, legal claims) are for occasional and non-repetitive transfers, not routine processing.

Due diligence on processors includes assessing security controls, sub-processor arrangements, data location, and breach history before engagement.

A written processor contract must include subject matter, duration, nature and purpose, instructions, confidentiality, security measures, sub-processor terms, assistance with rights and DPIAs, deletion or return, and audit rights.

Controllers remain accountable for processor compliance; processors that determine purposes or means become controllers for that processing.

Sub-processor engagement requires prior written authorisation from the controller and flow-down of equivalent obligations.