DPO cheat sheet

Personal data means any information relating to an identified or identifiable natural person; identifiability can be direct (name, ID number) or indirect (IP address, device ID, location data).

Special categories (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, sex life or sexual orientation) require a higher legal basis and usually explicit consent.

Six lawful bases for processing: consent, contract, legal obligation, vital interests, public task, legitimate interests. Legitimate interests is unavailable to public authorities acting in their public capacity.

Consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action; silence, pre-ticked boxes, or inactivity do not constitute consent.

Data protection principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

Data subject rights include access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making; responses are generally due within one month, extendable by two further months for complex requests.

A personal data breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness unless it is unlikely to result in a risk to rights and freedoms.

A controller determines the purposes and means of processing; a processor acts on the controller's documented instructions. The controller bears primary accountability for compliance.

Cross-border transfers require a transfer mechanism: adequacy decision, standard contractual clauses, binding corporate rules, or a specific derogation; a transfer impact assessment supports the chosen mechanism.

Three lines model: first line owns and manages risk operationally; second line provides independent oversight, policy, and compliance functions; third line (internal audit) gives independent assurance to the governing body.

Risk treatment options are accept, mitigate (reduce), transfer (e.g., cyber insurance, contractual allocation), and avoid; residual risk is the risk remaining after treatment and must be compared to the defined risk appetite.

Risk is typically scored as likelihood multiplied by impact; a risk register records owner, description, inherent risk, controls, residual risk, and treatment plan with target dates.

Accountability requires demonstrable compliance: records of processing activities, privacy policies, training records, DPIA outcomes, and audit trails. Documentation is the evidence of governance.

A Data Protection Impact Assessment is required for high-risk processing (large-scale special category data, systematic monitoring, innovative technology); it identifies risks and mitigations before processing begins.

A Data Protection Officer (where required) must be involved in all data protection matters, report to the highest management level, and be free from instructions on how to perform the role; conflicts of interest must be avoided.

Privacy by design and by default requires embedding protections into systems and settings so that only necessary data is processed without user action.

Key performance and key risk indicators (KPIs/KRIs) measure control effectiveness; metrics such as breach frequency, training completion, and DSAR turnaround evidence governance maturity.

Third-party risk management covers due diligence, contractual data processing terms, ongoing monitoring, and offboarding; vendor risk is a shared responsibility but the controller retains accountability.