Privacy and data protection
Privacy and data protection tests how personal data is collected, used, retained, and shared. Expect scenarios on lawful basis, data subject rights, vendor roles, breach notification, and privacy by design.
Core rules and concepts
- Core principles: lawfulness, fairness, transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.
- A controller decides why and how data is processed; a processor acts on the controller's instructions. Both have obligations, but the controller carries more accountability.
- Data subject rights include access, rectification, erasure, restriction, portability, and objection. Consent must be freely given, specific, informed, and withdrawable; it is one lawful basis, not the only one.
- Privacy by design and by default means minimizing collection, limiting access, and setting retention before launch. A DPIA is required for high-risk processing.
- Pseudonymization reduces identifiability but remains personal data. Anonymization must be irreversible. GDPR-style breach notification to a supervisory authority is generally within 72 hours of awareness when required.
Worked example
A marketing team wants to analyze purchase behavior. Use only necessary fields, aggregate where possible, pseudonymize identifiers, restrict access to the analytics group, set a retention period, and document the lawful basis. If the analysis uses precise location or profiling with legal effects, conduct a DPIA and offer an opt-out where required.
Traps that cost marks
Pseudonymized data is not anonymous. Consent is not the only lawful basis. Privacy is not identical to security, though controls overlap. A processor does not decide the purpose of processing.