GDPR EXTRACT Flashcards
(15 cards)
Q: What is the main goal of the GDPR?
A: To protect people’s personal data and privacy in the EU.
Example: A company must tell you how they use your email.
Q: What is personal data?
A: Any information that can identify a person.
Example: Name, phone number, address, email, IP address.
Q: What does processing mean?
A: Doing anything with personal data — like collecting, saving, changing, or deleting it.
Example: Signing up for a website = your data is being processed.
Q: Who is the data subject?
A: The person whose data it is.
Example: You, when you give your info to a shop.
Q: Who is the controller?
A: The person or company who decides why and how your data is used.
Example: An online store collecting your info.
Q: Who is the processor?
A: Someone who works with data on behalf of the controller.
Example: A company hired to store customer info for a website.
Q: What are the 7 GDPR principles?
- Lawfulness, fairness, transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity & confidentiality
- Accountability
Example: A business must only collect the data it really needs.
Q: When is processing data allowed? (Legal basis)
One of these must apply:
Consent
Contract
Legal duty
Protect someone’s life
Public interest
Legitimate interest (only if it doesn’t hurt the person’s rights)
Example: A bank can process your data for your account contract.
Q: What is consent under the GDPR?
A: It must be:
Freely given
Clear
Informed
Easy to take back
Example: You must click a box to agree — no pre-ticked boxes!
Q: What is sensitive personal data?
A: Personal data about:
Race
Religion
Politics
Health
Sexual orientation
Biometric or genetic info
Example: Fingerprints or medical records = special protection.
Q: Can companies use sensitive data?
Usually no — unless:
You gave clear consent
It’s needed for health, law, or public safety
Example: A hospital can use your health data for treatment.
Q: What age can children give consent online?
A: At least 16 years old (or 13–15 depending on the country)
Example: A 12-year-old needs a parent’s permission to sign up.
Q: What is a data breach?
A: When data is lost, stolen, or leaked by accident or attack.
Example: A hacker stealing customer emails.
Q: What is pseudonymisation?
Replacing names with fake IDs so the data cannot be linked to a person without extra info.
Example: “User #458” instead of “John Smith”.
Q: Who makes sure companies follow GDPR?
The supervisory authority (e.g., the Data Protection Authority in your country).
Example: In Belgium, it’s the GBA (Gegevensbeschermingsautoriteit).
