GDPR Foundation study plan

Define the six GDPR principles (lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality) and articulate their practical implications for a data processing activity.

Distinguish between personal data, pseudonymised data, and anonymous data, and classify a set of 10 example data items accordingly.

Identify the roles of controller, processor, and data subject in three different organisational scenarios.

Explain the material and territorial scope of the GDPR (Article 3) and determine whether a given processing scenario falls under the regulation.

List the six lawful bases for processing under Article 6 and explain when each is appropriate.

Differentiate consent requirements under Article 7 (freely given, specific, informed, unambiguous) and apply them to evaluate two sample consent forms.

Describe the special categories of personal data under Article 9 and the additional conditions for processing them.

Summarise the data subject rights (Articles 12–22) and match each right to its corresponding article and a typical organisational response.

Explain the obligations of controllers and processors under Articles 24, 28, and 29, including the required elements of a data processing agreement.

Outline the record-keeping duties under Article 30 and draft a sample record of processing activities entry.

Describe the principles of data protection by design and by default (Article 25) and identify three design measures for a new system.

Identify when a Data Protection Impact Assessment (Article 35) is required and list its minimum content.

Explain the requirements for a valid data breach notification to a supervisory authority (Article 33) and to data subjects (Article 34).

Apply the breach notification timeline (72 hours) and assess risk thresholds in two incident scenarios.

Describe the role and tasks of the Data Protection Officer (Articles 37–39) and determine when appointment is mandatory.

Summarise the transfer mechanisms under Chapter V (adequacy decisions, standard contractual clauses, binding corporate rules) and identify the conditions for each.

Compare the roles and powers of supervisory authorities (Chapter VI) and describe the one-stop-shop mechanism.

Outline the cooperation and consistency mechanism (Chapter VII) and explain its purpose in cross-border cases.

List the administrative fines and corrective measures available under Article 58 and the two-tier fine structure under Article 83.

Explain the right to an effective judicial remedy against a supervisory authority and against a controller or processor (Articles 78–79).

Integrate the principles, lawful bases, and data subject rights into a coherent analysis of a realistic processing scenario.

Evaluate the interplay between transparency obligations (Articles 12–14) and the practical delivery of privacy notices.

Assess the conditions for valid consent in online services, including children's consent (Article 8).

Identify the main differences between the GDPR and the predecessor Data Protection Directive 95/46/EC in at least five areas.

Complete a full-length practice exam under timed conditions and score it against an answer key.

Review every incorrect answer and write a one-sentence explanation of the correct rule for each.

Revisit weak areas from the practice exam and create flashcards for at least 20 key facts.

Explain the GDPR's accountability principle (Article 5(2)) and how it underpins the other obligations.

Consolidate all flashcards and notes into a one-page master summary of the GDPR structure and key articles.

Complete a second full-length practice exam and achieve a score of at least 80%.

Simulate explaining the GDPR's core principles and breach notification process to a non-specialist in under five minutes.

Finalise a personal exam-day strategy, including time allocation and question-reading techniques.