I85PREP
⌘ K
DPO study materials
DPO study resources

DPO: Privacy and Data Protection Fundamentals for the DPO

DPO · Work through your exam, one topic at a time.

All guide sections

Privacy and Data Protection Fundamentals for the DPO

Core concepts a DPO must command

A Data Protection Officer is expected to reason from principles, not just recite them. Know the distinction between personal data (any information relating to an identified or identifiable natural person) and anonymous data, and note that pseudonymised data remains personal data because re-identification is possible. Understand the lawful bases for processing and that consent is only one of them; questions often test whether a different basis (contract, legal obligation, legitimate interest) is more appropriate.

Master the data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. The DPO role itself carries specific duties: monitoring compliance, advising on impact assessments, acting as a contact point for regulators and data subjects, and being involved "properly and in a timely manner."

Traps to watch for

  • Independence vs. conflict of interest: a DPO cannot simultaneously hold a role that determines processing purposes and means. Questions may disguise this as a "convenient" dual role.
  • Reporting line: the DPO reports to the highest management level, not to IT or marketing.
  • Consent quality: silence, pre-ticked boxes, or bundled consent are invalid.
  • Extraterritorial reach: processing need not occur inside a jurisdiction for obligations to apply.

Worked rule of thumb

When a scenario asks "is this allowed?", run a four-step chain: (1) Is it personal data? (2) Is there a lawful basis? (3) Were the principles honoured (minimisation, purpose, retention)? (4) Are data subject rights and accountability satisfied? The first "no" is your answer.

For example, a marketing team wants to reuse customer emails for a new purpose. Emails are personal data; the original basis may not cover the new purpose; purpose limitation and transparency likely fail - so fresh consent or a compatible-purpose analysis is required.