Unit 3 Database - GDPR Data Protection Flashcards
What is the General Data Protection Regulation (GDPR)?
The GDPR is a set of rules designed to give EU citizens greater control over their personal data. It replaces and strengthens existing data protection laws, ensuring they remain relevant in the internet age.
When did GDPR come into effect?
GDPR came into force on May 25, 2018.
What is UK GDPR?
After the UK left the European Union, a version of GDPR known as UK GDPR was implemented as UK law.
What are the six key principles of GDPR regarding data processing?
- Processed lawfully, fairly, and transparently
- Used for the declared purpose only
- Limited to the necessary data
- Accurate
- Not kept longer than necessary
- Held securely
Who is a Data Subject under GDPR?
The individual whose personal data is being collected and processed.
What qualifies as Personal Data?
Any information that can directly identify an individual, such as their name, address, IP address, or device ID.
Who is a Data Controller?
An organization or company that determines how and why personal data is processed.
Who is a Data Processor?
A third-party entity that processes personal data on behalf of a Data Controller.
What is a Privacy Notice?
A document provided by the Data Controller informing the Data Subject about how their data will be processed and for how long.
What are the 8 rights of Data Subjects under GDPR?
- Right to be informed
- Right to access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
- Rights related to automated decision-making and profiling
Under what circumstances must personal data be erased?
- No longer needed for the original purpose
- Consent is withdrawn
- The Data Subject objects to processing
- Data was processed unlawfully
- Legal requirement to delete it
- Data was collected from a child without parental consent
What is the Right to Data Portability?
The right to move personal data between different services, such as downloading shopping history from a retailer.
What is the Right to Object?
The right to object to data processing for direct marketing, research, or where the processing is based on ‘legitimate interest’.
What is the Right to Challenge Automated Decision Making?
Data subjects can:
1. Request a human review of decisions
2. Express their viewpoint
3. Obtain an explanation of decisions
4. Challenge the decision
What are the lawful bases for processing data under GDPR?
- Consent
- Contract
- Legal Obligation
- Vital Interest
- Public Task
- Legitimate Interest
What is a Data Breach?
A security incident that results in personal data being lost, accessed by unauthorized parties, corrupted, or made unavailable.
