GDPR Foundation study guide
GDPR Foundation · Work through your exam, one topic at a time.
The PECB Certified GDPR Foundation credential is an entry-level certificate for people who need a working grasp of the EU General Data Protection Regulation and the privacy principles behind it. PECB positions the training for individuals involved in personal data protection and information security, individuals seeking knowledge of the main privacy principles, and individuals interested in pursuing a career in data protection. No prerequisites apply, and the certificate itself requires only passing the exam, signing the PECB Code of Ethics, and no professional or project experience. The course runs two days: Day 1 covers an introduction to GDPR and data protection principles, and Day 2 covers the GDPR requirements plus the certificate exam. Topics on this exam: Fundamental principles and concepts of the General Data Protection Regulation (GDRP) and General Data Protection Regulation (GDPR). The GDPR Foundation study guide has 2 sections and about 678 words.
01Fundamental Principles and Concepts of the GDPR
This domain checks whether you can classify data and roles correctly, then apply the Article 5 principles before choosing a legal basis. Personal data : information relating to an identified or identifiable person (Article 4(1)); identifiability may be indirect. Processing : nearly any operation on data, from collection to erasure (Article 4(2)). Controller : decides purposes and means (Article 4(7)); a processor acts on the controller's behalf (Article 4(8)).
322 words, about 2 min02General Data Protection Regulation (GDPR)
This domain tests the Regulation's reach and the operational duties that follow: scope, rights, accountability tools, breach handling and transfers. Article 3 applies to processing by an EU/EEA establishment, and to non-EU controllers or processors that offer goods or services to people in the EU or monitor their behaviour. Offering is assessed by targeting indicators, not by the mere accessibility of a website. A non-EU controller caught by Article 3(2) must generally appoint an Article 27 representative.
356 words, about 2 min