GDPR Foundation cheat sheet

Lawful bases for processing (Article 6): consent, contract, legal obligation, vital interests, public task, legitimate interests. Special category data (Article 9) requires an additional condition such as explicit consent or employment law.

Consent must be freely given, specific, informed, unambiguous, and indicated by a clear affirmative action; silence, pre-ticked boxes, or inactivity do not constitute consent (Article 4(11), Recital 32).

Data minimisation: personal data must be adequate, relevant, and limited to what is necessary for the purposes (Article 5(1)(c)).

Storage limitation: data kept no longer than necessary; specific time limits should be defined and documented (Article 5(1)(e)).

Accountability (Article 5(2)): the controller must be able to demonstrate compliance with all principles, e.g., via records, policies, and DPIAs.

Data subject rights include access, rectification, erasure, restriction, portability, and objection (Articles 15-21); the controller generally has one month to respond.

A personal data breach must be notified to the supervisory authority within 72 hours of becoming aware, unless unlikely to result in risk (Article 33); high-risk breaches require communication to data subjects without undue delay (Article 34).

The GDPR applies to controllers and processors established in the EU, and to non-EU entities offering goods/services to or monitoring EU data subjects (Article 3).

Pseudonymisation reduces risk but does not remove data from GDPR scope; anonymised data is outside the GDPR (Recital 26).

The GDPR (Regulation (EU) 2016/679) entered into force on 24 May 2016 and applies from 25 May 2018; it is directly applicable in all EU member states.

A controller determines the purposes and means of processing; a processor processes on behalf of the controller. Article 28 requires a written contract with processors.

DPIA (Article 35) is required for processing likely to result in high risk, e.g., large-scale systematic monitoring or special category data; consult the supervisory authority if residual high risk remains (Article 36).

A DPO (Articles 37-39) is mandatory for public authorities, large-scale systematic monitoring, or large-scale special category processing; the DPO must be independent and report to the highest management level.

Records of processing activities (Article 30) are required for organisations with 250+ employees, or fewer if processing is not occasional, risks rights, or involves special categories.

International transfers require an adequacy decision, appropriate safeguards (SCCs, BCRs), or a derogation (Articles 44-49); Schrems II (CJEU 2020) invalidated the EU-US Privacy Shield.

Administrative fines up to €20 million or 4% of global annual turnover, whichever is higher, for serious infringements (Article 83); lower tier up to €10 million or 2%.

The one-stop-shop mechanism (Article 56) allows the lead supervisory authority in the main establishment to act as lead for cross-border processing.

Certification (Article 42) and codes of conduct (Article 40) are voluntary tools to demonstrate compliance; they do not replace legal obligations.