GDPR - The Simplified Version

Explore the GDPR overview, including its 11 chapters and 99 articles, covering general provisions, principles, data subject rights, controllers and processors, transfers, supervisory authorities, cooperation, remedies, penalties, and final provisions.

Discuss article one’s subject matter and objectives of the GDPR, including protection of natural persons’ data, fundamental rights, and the free movement of data within the European Union.

Explore GDPR article 2 material scope and applicability, covering automated and non-automated processing in a structured filing system, with exceptions for personal use and government or law enforcement use.

Understand GDPR's territorial scope, article 3: it applies when an organization has EU establishment, offers goods or services to EU residents, monitors EU users, or falls under member state law.

Discover how GDPR defines personal data, including names, identifiers, location data, and online identifiers, and how processing, controller, and processor roles govern data handling.

Remember seven principles of GDPR by the abbreviation lamy, focusing on lawfulness fairness and transparency, purpose limitation, storage limitation, accuracy, accountability, minimization, and integrity and confidentiality.

Learn article five of GDPR and the seven principles for processing personal data, including lawfulness, fairness, and transparency, data minimization, accuracy, storage limitation, data integrity and confidentiality, and accountability.

outline article seven of the gdpr, detailing four subclauses: demonstrate consent, clear and plain language, right to withdraw, and no coercion, with withdrawal as easy as consent.

Explore article 8 of GDPR, clarifying when a child's consent is valid for information society services, the 16-year default, parental consent for younger children, and verification duties for controllers.

Learn how article nine governs processing of special categories of personal data, including racial or ethnic origin and health data. Identify the exceptions, such as explicit consent or legal obligation.

Clarify article 10 of GDPR, defining when processing criminal conviction data is allowed—only by an official authority or under specific law that protects rights—and ensure registers remain under official control.

Explore how Article 11 allows processing personal data without identifying the subject, where the purpose determines identification; learn when additional information triggers normal GDPR rules.

Learn Article 12 of the GDPR, detailing clear information, eight clauses, and how data subjects exercise rights with defined timelines. Explore timelines, extensions, and identity verification.

Article 13 requires organizations to inform data subjects at collection with organization details and contact details, purpose, legal basis, recipients, cross-border transfers, rights, consent withdrawal, complaints, and automated decision details.

Explain article 14 of GDPR, when data is not collected from the data subject, outlining required information such as controller identity, DPO, purpose, legal basis, data categories, recipients, and rights.

Explore article 15, the right of access for the data subject, including what data is collected, purposes, recipients, retention, and rights to rectification, erasure, restriction, and automated decision making.

Explain article 16 rights: data subjects can rectify inaccurate data or complete missing records, with the controller fixing data promptly and considering processing purposes.

Explain Article 17’s right to erasure, including when deletion is required, comprehensive deletion, exceptions, and informing other recipients of the erasure request.

Explore how GDPR article 18 grants individuals the right to restrict processing in four circumstances, shows what a controller may do with restricted data, and explains lifting restrictions.

Identify article 19's notification obligation: controllers must inform data recipients of rectification, erasure, or restriction, unless impossible or disproportionate, and notify data subjects upon request.

Explain GDPR article 20, data portability right to move personal data between services in a commonly used, machine-readable format, when processing is based on consent or contract and automated processing.

Explore article 21 of GDPR, detailing the right to object to personal data processing, including direct marketing and processing in public interest, with exceptions for compelling grounds or legal claims.

Explore GDPR article 22 on automated decision making, profiling, and the rights to human intervention, to express views, and to contest decisions, including contract, legal, and explicit consent exceptions.

Explore article 23 of the GDPR, outlining when a union or member state may restrict data subject rights for national security, defense, public security, and public interest, with required justification.

Analyze article 24 of the GDPR, outlining the controller's responsibility to implement and demonstrate technical and organizational measures, and to develop data protection policies and codes of conduct or certifications.

Explore data protection by design and by default under article 25, applying state-of-the-art measures, understanding the nature, scope, context, and purposes of processing, and using pseudonymisation and data minimization.

Identify how two or more controllers become joint controllers by jointly determining purposes and means while providing a transparent arrangement for data subjects to exercise rights against each controller.

Define controller and processor roles under article 28. Outline a processor’s obligations to guarantee data protection, obtain authorization for sub-processors, and maintain written contracts.

Learn how article 29 mandates data be processed on instructions from the controller, unless required by union or member state law, and identify who may give instructions to the processor.

Learn how controllers and processors maintain records of processing activities, detailing data categories, purposes, recipients, transfers, erasure timelines, and security measures, with exemptions for small organizations.

Examine article 32 of the GDPR, outlining security of processing through measures like pseudonymization, encryption, confidentiality, integrity, resilience, and risk considerations such as accidental destruction or unauthorized access.

Learn how GDPR article 33 governs notifying the supervisory authority about personal data breaches within 72 hours, and the roles of controller and processor, plus required content and documentation.

Explore GDPR article 34: notify data subjects of a high-risk personal data breach without undue delay, in clear language, include DPO contact, likely consequences, and measures taken or proposed.

explains article 35 data protection impact assessment requirements, including when to conduct DPIAs, the role of the data protection officer, mandatory processing scenarios, and DPIA content.

Learn how article 36 requires prior consultation with the supervisory authority when a data protection impact assessment shows high risk, with eight-week response timelines, possible six-week extensions, and required information.

Learn how to designate a data protection officer under Article 37, including mandatory scenarios, group appointments, qualifications, duties, and how to publish contact details.

Explain article 38 requirements for the data protection officer: timely involvement, access to data, independence, resources, expertise, confidentiality, not receiving instructions, and direct reporting to the highest management.

outline article 39 tasks for the data protection officer, including informing and advising controllers and processors, monitoring compliance, staff training and audits, cooperating with authorities, and considering processing risks.

Explore the data protection officer’s GDPR responsibilities under article 39, including informing and advising controllers or processors, monitoring compliance, audits, and cooperation with supervisory authority. Assess risk under article 39.2.

Learn how Article 45 enables transfers to third countries or international organizations when the European Commission decides an adequate level of data protection and no specific authorization is required.

Article 46 governs international data transfers with safeguards, including legally binding instruments, binding corporate rules, standard data protection clauses, codes of conduct, certified mechanisms, and supervisory-approved contractual or administrative safeguards.

Explain article 82 of the GDPR: the right to compensation, controller and processor liability, exemptions, joint liability for damages, and recovery of damages and court provisions.

Under article 83, the supervisory authority decides if and how much to fine, weighing nature, gravity, duration, data subjects affected, damage, intent, mitigation, cooperation, and prior infringements.