Data Protection Principles and Legal Frameworks
Start with the architecture: a data protection law defines personal data (information relating to an identified or identifiable person) and then constrains how controllers and processors may handle it. Know the difference cold - the controller determines purposes and means; the processor acts on the controller's documented instructions and owes its own security and sub-processor duties. Most legal frameworks (GDPR-style regimes, national laws, sector rules) share a common skeleton: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Learn each principle as a testable rule, not a slogan.
Traps candidates fall for
- Treating anonymisation and pseudonymisation as synonyms. Pseudonymised data is still personal data; truly anonymised data falls outside scope.
- Assuming principles are absolute. Accuracy, storage limitation and purpose limitation admit narrow exceptions (legal claims, archiving, research).
- Forgetting that accountability requires demonstrable evidence (records, policies, logs), not just good intent.
- Confusing special category data (health, biometrics, ethnicity, etc.) with ordinary data - it needs an additional condition beyond a lawful basis.
Rule of thumb
For any scenario question, run the P-L-M-A-S-I-A sweep: Purpose? Lawful basis? Minimised? Accurate? Storage limited? Integrity/confidentiality? Accountability evidence? The first failing letter usually names the correct answer.
Worked example: A retailer keeps abandoned-cart emails for marketing indefinitely. Purpose limitation fails (marketing consent doesn't cover indefinite retention) and storage limitation fails. The fix is a defined retention schedule plus re-consent, not merely a privacy notice update.