GDPR Principles and Compliance Questions

The General Data Protection Regulation in depth: the six lawful bases, data subject rights, accountability and records obligations, DPO requirements, and enforcement and fines. Covers how GDPR principles translate into concrete engineering and product controls. Includes controller and processor obligations and demonstrating compliance.

EasyTechnical

139 practiced

Summarize the GDPR obligations that most impact architecture decisions: data minimization, purpose limitation, data subject rights, Data Protection Impact Assessments (DPIA), lawful bases for processing, and cross-border data transfer constraints. For each obligation give a one-sentence architectural implication and note when to consult the DPO.

Sample Answer

**Intro (role perspective)** As a Security Architect I translate GDPR obligations into concrete design constraints and controls—below are concise architectural implications and when to consult the DPO.

- **Data minimization** Architectural implication: Design systems to collect, store, and retain only the minimal attributes required (use attribute-based access, tokenization, and schema-level pruning). Consult DPO: Before changing data models or adding new data collection to validate necessity.

- **Purpose limitation** Architectural implication: Enforce purpose-tagging of data at ingestion and policy-driven access controls that prevent secondary uses. Consult DPO: When introducing new data uses, analytics, or sharing that may deviate from declared purposes.

- **Data subject rights** Architectural implication: Build auditable workflows, subject-access APIs, and reversible pseudonymization to support access, rectification, erasure, portability. Consult DPO: When designing erasure/portability processes or automated fulfillment that may impact systems.

- **Data Protection Impact Assessments (DPIA)** Architectural implication: Integrate DPIA checkpoints into design lifecycle; require threat models and mitigation mapping for high-risk processing. Consult DPO: At project start for any high-risk processing, new technologies, or large-scale profiling.

- **Lawful bases for processing** Architectural implication: Implement consent management, recordkeeping, and conditional processing gates tied to legal basis metadata. Consult DPO: When defining which lawful basis applies or changing processing that may affect legal basis.

- **Cross-border transfer constraints** Architectural implication: Architect data residency controls, encryption-in-transit/at-rest, and contractual/SCC mechanisms with selectable storage regions. Consult DPO: Before sending data outside the EEA or using third‑party cloud regions.

If needed I map these into controls (encryption, logging, consent stores, access policies) and incorporate them into threat models and architecture review checklists.

Unlock Full Question Bank

Get access to hundreds of GDPR Principles and Compliance interview questions and detailed answers.

Join thousands of developers preparing for their dream job.