GDPR Foundation common mistakes
GDPR Foundation · Understand the traps and how to avoid them.
Treating consent as the default or preferred lawful basis for most processing, and answering 'get consent' whenever a scenario involves employee data, marketing lists, or public-sector processing.
Consent is the lawful basis most heavily publicised, so candidates anchor on it and forget the other five bases in Article 6; they also overlook that consent is hard to withdraw-free and inappropriate where there is a power imbalance such as employment.
What to do instead
Before answering any lawful-basis question, run through all six Article 6 bases and ask which one genuinely describes the relationship. Memorise that public authorities cannot rely on legitimate interests for their public tasks, that consent must be freely given and as easy to withdraw as to give, and that a different basis may be needed for special-category data under Article 9.
Confusing the roles of controller and processor, for example calling a cloud hosting provider the controller because it stores the data, or calling the customer the processor because it owns the data.
Candidates reason from who physically holds the data rather than who determines the purposes and means of processing; the terminology also sounds counterintuitive to non-lawyers.
What to do instead
Apply the test: the controller decides why and how processing happens; the processor acts on the controller's documented instructions. Practise classifying two-tier supply chains, and remember a processor that goes beyond instructions or determines its own purposes becomes a controller for that processing, with joint controllership possible under Article 26.
Answering Data Protection Officer questions as if a DPO were mandatory for every organisation that processes personal data, or describing the DPO as personally liable for compliance failures.
The DPO is the most visible GDPR role, so candidates overgeneralise the Article 37 triggers and mix up the DPO's advisory and monitoring tasks with the controller's accountability obligations.
What to do instead
Memorise the three Article 37 triggers: large-scale regular and systematic monitoring, large-scale special-category or criminal-offence data as a core activity, and public authority status (with the narrow judicial-function exception). State that the DPO monitors and advises, reports to the highest management level, is bound by secrecy, and that the controller remains accountable.
Quoting fixed deadlines and thresholds that do not exist in the Regulation, such as 'a 72-hour deadline to respond to data subject requests', 'breach notification within 24 hours', or '250 employees means GDPR does not apply'.
Numbers from other regimes, national laws, or popular summaries get absorbed as GDPR facts, and the small-organisation derogation in Article 30 is misread as a general exemption.
What to do instead
Build a one-page number sheet from the text: one month for data subject requests with a possible two-month extension, 72 hours for supervisory authority breach notification, 30 days for replying to a subject access request only where national law says so, and no employee-count threshold for applicability. For Article 30, note the exemption is narrow and does not remove other obligations.
Treating the Article 30 records of processing as optional paperwork, or assuming a small company never needs them, instead of recognising them as a core accountability tool.
The records requirement feels administrative and the exemption wording is easy to skim, so candidates underestimate its role in demonstrating compliance and supporting breach response.
What to do instead
Learn the required record contents (purposes, categories of data and data subjects, recipients, transfers and safeguards, retention periods, security measures) and the narrow exemption for organisations under 250 employees whose processing is not regular, not high-risk, and does not involve special categories. Link records to accountability under Article 5(2) and to breach assessment.
Mishandling data subject rights by applying a blanket rule, such as always charging a fee, always refusing manifestly unfounded requests without evidence, or assuming the right to erasure overrides every other obligation.
Rights questions are scenario-based and candidates simplify them into absolutes, forgetting the exceptions, the burden of proof on the controller, and the interaction with legal obligations and freedom of expression.
What to do instead
For each right, learn the conditions and exceptions: erasure yields to legal retention obligations and legal claims; access can be limited by third-party rights; fees are exceptional and must be justified; refusal of manifestly unfounded or excessive requests requires demonstrable grounds. Practise identifying which right applies and whether an exception is triggered.
Answering international transfer questions by naming a mechanism without checking its conditions, for example saying Standard Contractual Clauses alone always suffice, or treating an adequacy decision as covering every type of data and every recipient.
The transfer chapter has many overlapping tools and the Schrems II case law changed practice, so candidates memorise tool names but not the requirement for a transfer impact assessment and supplementary measures.
What to do instead
Learn the Chapter V hierarchy: adequacy first, then appropriate safeguards (SCCs, binding corporate rules, approved codes or certification) with enforceable rights, then narrow derogations for occasional transfers. State that SCCs require a case-by-case assessment of the destination's law and, where needed, supplementary technical and organisational measures.
Confusing the one-stop-shop and lead supervisory authority rules, or assuming any authority can always act as lead, when answering cross-border processing scenarios.
The cooperation and consistency mechanism is structurally complex, and candidates conflate main establishment, lead authority, and the situations where a local authority may still act.
What to do instead
Learn that the lead authority is determined by the controller's or processor's main establishment in the EU, that one-stop-shop applies to cross-border processing, and that a local authority can act where the matter is local or where urgent action is needed under Article 66. Note the consistency mechanism and the EDPB's role in disputes.
Giving a generic 'we take security seriously' answer to security and breach scenarios instead of naming concrete Article 32 measures and the correct notification decision path.
Security questions invite vague reassurance, and candidates do not separate the two breach duties: notifying the supervisory authority and notifying affected data subjects, each with its own threshold.
What to do instead
List specific measures: encryption, pseudonymisation, resilience, restore capability, regular testing, and risk-appropriate organisational controls. For breaches, apply the sequence: assess risk to rights and freedoms, notify the authority within 72 hours unless unlikely to result in risk, notify data subjects without undue delay where high risk, and document all breaches regardless.
Missing the interplay between the GDPR and other regimes, such as applying GDPR breach rules to purely national security processing, or ignoring the ePrivacy rules on cookies and electronic marketing when a scenario involves tracking.
The Regulation's material and territorial scope has specific carve-outs, and candidates study GDPR in isolation without the lex specialis for electronic communications or the national security exclusion in Article 2.
What to do instead
Learn Article 2 exclusions (purely personal or household activity, law enforcement under the LED, national security, EU institutions under Regulation 2018/1725) and Article 3 territorial reach, including offering goods or services to and monitoring EU data subjects. Flag ePrivacy consent rules for cookies and marketing as separate from GDPR lawful basis.