Data Protection Fundamentals and Legal Frameworks
Domain 1 - Data protection fundamentals and legal frameworks
This domain tests whether you can identify personal data and processing, select a lawful basis, apply the GDPR principles and scope rules, and choose the right transfer mechanism. Expect scenario questions that mix EU law with international instruments.
Core rules
- Personal data is any information relating to an identified or identifiable natural person; pseudonymized data remains personal data, anonymized data does not.
- Principles (Art. 5): lawfulness, fairness, transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.
- Legal bases (Art. 6): consent, contract, legal obligation, vital interests, public task, legitimate interests. Special categories (Art. 9) need an additional condition, such as explicit consent or employment law.
- Scope (Art. 3): an EU establishment processing in the context of its activities, or targeting or monitoring EU data subjects.
- Transfers (Chapter V): adequacy decision, appropriate safeguards such as SCCs or BCRs, or narrow derogations. After Schrems II, SCCs require a transfer impact assessment and supplementary measures.
Worked example
An EU retailer sends payroll data to a US support vendor and relies on the invalidated Privacy Shield. The transfer is unlawful. Reasoning: adequacy is gone; SCCs are a valid tool but only after a TIA shows U.S. law does not undermine essential protections. Encryption and access controls may supplement safeguards, but not if the vendor must access clear data. The retailer must document the assessment.
Traps
Confusing controller and processor; assuming consent is always the best basis; treating pseudonymization as anonymization; ignoring ePrivacy rules for cookies and marketing; assuming an adequacy decision covers every transfer.