Fundamental Principles and Concepts of the GDPR
What this domain tests
This domain checks whether you can classify data and roles correctly, then apply the Article 5 principles before choosing a legal basis.
Core definitions
- Personal data: information relating to an identified or identifiable person (Article 4(1)); identifiability may be indirect.
- Processing: nearly any operation on data, from collection to erasure (Article 4(2)).
- Controller: decides purposes and means (Article 4(7)); a processor acts on the controller's behalf (Article 4(8)). Contract labels do not decide the role.
- Pseudonymised data remains personal data; anonymised data does not.
The principles
Article 5 requires lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. Accountability (Article 5(2)) means demonstrating compliance. Processing needs an Article 6 basis; special category data also needs an Article 9 condition.
Worked example
A gym app logs heart rate, pregnancy status and full medical history, and a cloud host stores it only on instruction. The gym decides why and how, so it is controller; the host is processor. Heart rate and pregnancy status are health data (Article 4(15)), so the gym needs an Article 6 basis plus an Article 9 condition, such as explicit consent. Collecting full history breaches data minimisation if heart rate suffices; indefinite retention breaches storage limitation.
Traps
- Calling pseudonymised data anonymous.
- Assuming consent is always required; it may be inappropriate where power is imbalanced.
- Using legitimate interests for a public authority's official tasks.
- Giving special category data only one legal hook.