GDPR

Question 1

Covered entities?

Answer 1

1. Processing of personal data when a controller or processor is established in the EU, regardless of whether or
   not the actual processing takes place in the EU
2. Processing of personal data of EU subjects relating to offering goods or services or monitoring behaviour,
   regardless of whether or not the controller or processor is established in the EU
3. Processing of personal data by a controller not established in the EU but in a place where member state law
   applies

Question 2

Rights to individuals?

Answer 2

Access
Erasure
Rectification
Restriction of processing
Data Portability
Object to processing 
No profiling

Question 3

Who is covered by this law?

Answer 3

EU Data Subjects. Doesn’t matter if the data is processed in the EU or not

Question 4

Provisions of the EU’s General Data Protection Regulation (GDPR) include

Answer 4

Accountability obligations
Rules for international data transfers
Requirements for processors (contractors who act on behalf of data controllers)
Designation of data protection officers
Notification of security breaches

Question 5

Fines

Answer 5

Sanctions of up to €20 million or four percent of total annual, worldwide revenues.

Question 6

Exclusions

Answer 6

• Activities outside the scope of EU law (e.g., national security activities)
• Law enforcement and public security
• Purely personal or household activities

Question 7

US Safe Harbor

Answer 7

Overturned in 2015 due to US government surveillance

Question 8

A multinational company can transfer data between countries after certification of their practices by an EU privacy supervisory agency

Answer 8

Binding Corporate Rules (BCR)

Question 9

A company adopts EU-approved contractual provisions requiring compliance with EU law and submission to the supervision of an EU privacy supervisory agency

Answer 9

Standard Contractual Clauses (SCC)

Question 10

Other approved transfer mechanisms

Answer 10

Codes of conduct and certification mechanisms

Ad hoc contractual clauses authorized by supervisory authorities (i.e., non-standardized contractual clauses)

Question 11

EDPB

Answer 11

European Data Protection Board

Question 12

Privacy by design accountability

Answer 12

Controllers

Question 13

Privacy by default accountability

Answer 13

Controllers

Question 14

DPIAs accountability

Answer 14

Controllers (Where required) and processors (to assist)

Question 15

Data Protection Officers accountability

Answer 15

Controllers and Processors where required

Question 16

Record keeping accountability

Answer 16

Controllers and processors

Question 17

Security accountability

Answer 17

Controllers and processors

Question 18

Data Breach Reporting accountability

Answer 18

Controllers (to regulators) and processors (to controllers)