Principles of Data Protection Quiz

The Purpose Limitation principle states that personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. This is a core principle under GDPR Article 5(1)(b).

Data Minimisation requires that personal data collected must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Organizations should avoid collecting excessive or unnecessary data.

The Accuracy principle under GDPR Article 5(1)(d) requires that personal data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that inaccurate data is erased or rectified without delay.

The Accountability principle requires that the data controller is responsible for, and must be able to demonstrate compliance with, all data protection principles. This includes maintaining records, conducting impact assessments, and implementing appropriate policies.

The Storage Limitation principle states that personal data should be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed. Organizations must establish data retention schedules.

GDPR Article 6 lists six lawful bases for processing: consent, contract, legal obligation, vital interests, public task, and legitimate interests. 'Financial benefit of a third party' is not a recognized lawful basis for processing personal data.

The Integrity and Confidentiality principle (also known as the Security principle) requires that personal data be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage, using appropriate technical or organizational measures.

The Right to Erasure, also known as the 'Right to be Forgotten' under GDPR Article 17, allows individuals to request the deletion of their personal data when it is no longer necessary for the purpose it was collected, or when consent is withdrawn, among other conditions.

Lawfulness, Fairness, and Transparency is the first principle under GDPR Article 5(1)(a). It requires that personal data be processed lawfully (with a valid legal basis), fairly (not in a way that is detrimental or misleading), and transparently (data subjects must be informed about how their data is used).

Under GDPR Article 35, a Data Protection Impact Assessment (DPIA) is mandatory when processing is likely to result in a high risk to the rights and freedoms of natural persons. This includes large-scale processing of sensitive data, systematic monitoring, or use of new technologies.