PECB CDPO cheat sheet

Personal data = any information relating to an identified or identifiable natural person; identifiability can be direct (name, ID number) or indirect (IP address, device ID, location data, pseudonymous keys linked to a record).

Core processing principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

Lawful bases under the GDPR model are exhaustive and mutually exclusive: consent, contract, legal obligation, vital interests, public task, legitimate interests; special-category data additionally requires an Article 9 condition.

Consent validity test: freely given, specific, informed, unambiguous, demonstrated by clear affirmative action; silence, pre-ticked boxes and inactivity do not constitute consent.

Data subject rights set: information, access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making including profiling.

Controller determines purposes and means of processing; processor acts only on documented controller instructions; joint controllers share determination and must allocate responsibilities transparently.

Cross-border transfer mechanisms: adequacy decision, standard contractual clauses, binding corporate rules, certified codes, and derogations for occasional, non-repetitive transfers.

Breach notification clocks under the GDPR model: 72 hours to the supervisory authority after awareness where risk is likely; without undue delay to data subjects where risk is high.

Accountability requires demonstrable compliance: policies, processing records, training evidence, DPIAs, and audit trails must be producible on request, not merely asserted.

DPO designation is mandatory for public authorities, large-scale regular and systematic monitoring, or large-scale special-category/criminal-data processing; otherwise designation is voluntary but triggers the same duties.

DPO duties: inform and advise, monitor compliance, advise on DPIAs, cooperate with the supervisory authority, act as contact point; the DPO may not be dismissed or penalised for performing the role.

DPO independence rule: the DPO must report to the highest management level, must not be instructed on the exercise of the role, and must be free of conflicts of interest.

RACI discipline: the controller owns lawful basis and purpose; the DPO advises and monitors but does not decide; IT operates controls; business owners accept residual risk.

Record of processing activities (ROPA) content: purposes, categories of data subjects and data, recipients, third-country transfers and safeguards, retention periods, and security measures.

Processor obligations: process only on instructions, ensure confidentiality, assist with data subject rights and DPIAs, notify breaches to the controller, delete or return data at contract end, permit audits.

Joint controllership exists where two or more parties jointly determine purposes and means; the arrangement's essence must be made available to data subjects.

Risk = likelihood × severity of harm to individuals; assess impact on rights and freedoms, not just organisational or financial loss.

DPIA trigger tests: systematic and extensive evaluation including profiling, large-scale special-category or criminal data, large-scale systematic monitoring of a publicly accessible area, or novel technology with high residual risk.

DPIA structure: description of processing and purposes, necessity and proportionality assessment, risk identification, mitigation measures, residual risk conclusion, DPO advice, and sign-off owner.

Prior consultation is required when residual risk remains high after mitigation; the supervisory authority then has a defined review window before processing may start.

Risk treatment options are avoid, reduce, transfer, or accept; acceptance must be documented with a named risk owner and a review date.

Threat modelling inputs for privacy: unauthorised access, re-identification from pseudonymised or aggregated data, excessive retention, function creep, inaccurate data, and insecure transfers.

Vendor and transfer risk: assess processor security posture, sub-processor chains, breach notification timelines, audit rights, and transfer safeguards before onboarding.

DPIA is a living record: re-run when the processing changes materially, when new technology is introduced, or when the risk landscape shifts; monitor mitigations for effectiveness.

Program lifecycle: scope and governance, gap assessment against a chosen framework, policy and procedure design, control implementation, awareness training, monitoring, and continual improvement.

Policy hierarchy: charter or framework policy, topic-specific policies (retention, transfers, breach, access), standards, procedures, and work instructions; each layer must trace upward.

Privacy by design and by default: embed protections at design stage, minimise collection and disclosure by default, and document design decisions in project gate reviews.

Key performance indicators measure activity (training completion, DPIA coverage, ROPA currency); key risk indicators measure exposure (open high risks, overdue mitigations, rising complaint volume).

Monitoring methods: control self-assessments, internal audits, access-log reviews, retention-purge verification, vendor reviews, complaint and incident trend analysis, and DSAR response-time tracking.

Breach response runbook: detect and contain, assess risk, notify within the legal clock where required, document the incident and decisions, remediate root cause, and update the register.

Training effectiveness is evidenced by role-based content, completion records, and testing outcomes; generic annual completion alone does not demonstrate competence.

Continual improvement loop: findings feed a corrective-action register with owner, due date, and verification of closure; management review confirms resourcing and priorities.

Personal data = any information relating to an identified or identifiable natural person; identifiability can be direct (name, ID number) or indirect (IP address, device ID, location data, pseudonymous keys linked to a record).

Core processing principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

Lawful bases under the GDPR model are exhaustive and mutually exclusive: consent, contract, legal obligation, vital interests, public task, legitimate interests; special-category data additionally requires an Article 9 condition.

Consent validity test: freely given, specific, informed, unambiguous, demonstrated by clear affirmative action; silence, pre-ticked boxes and inactivity do not constitute consent.

Data subject rights set: information, access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making including profiling.

Controller determines purposes and means of processing; processor acts only on documented controller instructions; joint controllers share determination and must allocate responsibilities transparently.

Cross-border transfer mechanisms: adequacy decision, standard contractual clauses, binding corporate rules, certified codes, and derogations for occasional, non-repetitive transfers.

Breach notification clocks under the GDPR model: 72 hours to the supervisory authority after awareness where risk is likely; without undue delay to data subjects where risk is high.

Accountability requires demonstrable compliance: policies, processing records, training evidence, DPIAs, and audit trails must be producible on request, not merely asserted.

DPO designation is mandatory for public authorities, large-scale regular and systematic monitoring, or large-scale special-category/criminal-data processing; otherwise designation is voluntary but triggers the same duties.

DPO duties: inform and advise, monitor compliance, advise on DPIAs, cooperate with the supervisory authority, act as contact point; the DPO may not be dismissed or penalised for performing the role.

DPO independence rule: the DPO must report to the highest management level, must not be instructed on the exercise of the role, and must be free of conflicts of interest.

RACI discipline: the controller owns lawful basis and purpose; the DPO advises and monitors but does not decide; IT operates controls; business owners accept residual risk.

Record of processing activities (ROPA) content: purposes, categories of data subjects and data, recipients, third-country transfers and safeguards, retention periods, and security measures.

Processor obligations: process only on instructions, ensure confidentiality, assist with data subject rights and DPIAs, notify breaches to the controller, delete or return data at contract end, permit audits.

Joint controllership exists where two or more parties jointly determine purposes and means; the arrangement's essence must be made available to data subjects.

Risk = likelihood × severity of harm to individuals; assess impact on rights and freedoms, not just organisational or financial loss.

DPIA trigger tests: systematic and extensive evaluation including profiling, large-scale special-category or criminal data, large-scale systematic monitoring of a publicly accessible area, or novel technology with high residual risk.

DPIA structure: description of processing and purposes, necessity and proportionality assessment, risk identification, mitigation measures, residual risk conclusion, DPO advice, and sign-off owner.

Prior consultation is required when residual risk remains high after mitigation; the supervisory authority then has a defined review window before processing may start.

Risk treatment options are avoid, reduce, transfer, or accept; acceptance must be documented with a named risk owner and a review date.

Threat modelling inputs for privacy: unauthorised access, re-identification from pseudonymised or aggregated data, excessive retention, function creep, inaccurate data, and insecure transfers.

Vendor and transfer risk: assess processor security posture, sub-processor chains, breach notification timelines, audit rights, and transfer safeguards before onboarding.

DPIA is a living record: re-run when the processing changes materially, when new technology is introduced, or when the risk landscape shifts; monitor mitigations for effectiveness.

Program lifecycle: scope and governance, gap assessment against a chosen framework, policy and procedure design, control implementation, awareness training, monitoring, and continual improvement.

Policy hierarchy: charter or framework policy, topic-specific policies (retention, transfers, breach, access), standards, procedures, and work instructions; each layer must trace upward.

Privacy by design and by default: embed protections at design stage, minimise collection and disclosure by default, and document design decisions in project gate reviews.

Key performance indicators measure activity (training completion, DPIA coverage, ROPA currency); key risk indicators measure exposure (open high risks, overdue mitigations, rising complaint volume).

Monitoring methods: control self-assessments, internal audits, access-log reviews, retention-purge verification, vendor reviews, complaint and incident trend analysis, and DSAR response-time tracking.

Breach response runbook: detect and contain, assess risk, notify within the legal clock where required, document the incident and decisions, remediate root cause, and update the register.

Training effectiveness is evidenced by role-based content, completion records, and testing outcomes; generic annual completion alone does not demonstrate competence.

Continual improvement loop: findings feed a corrective-action register with owner, due date, and verification of closure; management review confirms resourcing and priorities.