GDPR Principles and Compliance Questions

The General Data Protection Regulation in depth: the six lawful bases, data subject rights, accountability and records obligations, DPO requirements, and enforcement and fines. Covers how GDPR principles translate into concrete engineering and product controls. Includes controller and processor obligations and demonstrating compliance.

HardTechnical

78 practiced

Design controls and processes for handling PII and regulatory compliance (GDPR, CCPA) in multi-region BI dashboards. Cover data minimization, encryption at rest and in transit, access controls and least privilege, pseudonymization/anonymization strategies for aggregated views, consent and erasure workflows, audit logs for data access, and how you'd demonstrate compliance to auditors.

Sample Answer

Requirements & scope:- Only BI/aggregated outputs in scope; no raw PII in dashboards unless explicitly justified and approved by Data Protection Officer (DPO).- Regulatory targets: GDPR (EU), CCPA/CPRA (CA), plus regional data residency.

Controls & processes

1) Data minimization & ingestion- Implement "deny-by-default" ETL: accept only fields required for reports. Require a documented Data Use Case (who, why, retention).- Mask or drop direct identifiers at source where possible. Store raw PII in a sealed, access-controlled vault only when necessary.

2) Encryption- At rest: AES-256 for databases and object stores; column-level encryption for sensitive fields.- In transit: TLS 1.2+ for all API/db connections; VPN/PrivateLink for cross-region replication.- Key management: centralized KMS (e.g., AWS KMS) with restricted admin roles and key rotation policy.

3) Access control & least privilege- Role-based access (RBAC) for BI tools + attribute-based checks for row-level security (RLS).- Principle: analysts get transformed/aggregated datasets; only a small ops group can access PII vault with just-in-time (JIT) elevated access and MFA.- Automated provisioning via SCIM tied to HR systems; quarterly access reviews.

4) Pseudonymization & anonymization- For aggregated views use irreversible hashing with per-environment salt or tokenization service; for small cohorts apply differential privacy noise or k-anonymity thresholds (e.g., suppress counts < 10).- Provide options: pseudonymized IDs for tracking while preventing re-identification; fully anonymized datasets for broad reporting.

5) Consent & erasure workflows- Source systems must carry consent/opt-out flags and a deletion token. ETL respects flags: exclude opted-out individuals and trigger pipeline to remove/avoid rehydration of PII.- Erasure: orchestration that locates and deletes/flags PII across source, BI cache, backups; maintain async audit events until completion. Retention policies enforced automatically.

6) Audit logging & monitoring- Immutable logs (WORM) for data access and ETL jobs, including user, query, columns accessed, timestamp, purpose. Store logs centrally with SIEM and alert on anomalous access patterns.- BI dashboards record query-level logs; exportable reports for audits.

7) Demonstrating compliance to auditors- Maintain an evidence pack: Data Use Case registry, Data Flow diagrams, Data Processing Agreements, consent records, retention schedules, access lists, key rotation records, audit logs, and test reports for anonymization effectiveness.- Provide sample RLS policies, screenshots of KMS key policies, and live query logs. Run periodic tabletop exercises and produce SOC2/ISO27001, DPIA, and Data Protection Impact Assessment documents as applicable.

Example scenario:- Executive churn dashboard uses pseudonymized user_id, suppresses cohorts <10, queries go to an aggregated materialized view; any analyst request for raw PII requires DPO-approved ticket, JIT access, and is logged.

This design balances usability for BI with legal and technical safeguards; enforce with automation, audits, and clear owner-and-process documentation.

Unlock Full Question Bank

Get access to hundreds of GDPR Principles and Compliance interview questions and detailed answers.

Join thousands of developers preparing for their dream job.