GDPR requirements in Cybersecurity - Mini Project: Build & Apply

Understanding GDPR Requirements

📖 Scenario: You work in a company that handles customer data. Your manager asks you to create a simple checklist of key GDPR requirements to ensure the company respects privacy laws.

🎯 Goal: Build a clear checklist of the main GDPR requirements using a dictionary structure. This checklist will help your team remember important rules to follow when handling personal data.

📋 What You'll Learn

Create a dictionary with exact GDPR requirement names as keys and their short descriptions as values

Add a variable to count how many GDPR requirements are listed

Use a loop to create a new dictionary with only requirements that mention 'consent'

Add a final statement confirming the checklist is ready

💡 Why This Matters

🌍 Real World

Companies must understand and follow GDPR rules to protect customer privacy and avoid legal penalties.

💼 Career

Knowledge of GDPR is essential for roles in data protection, compliance, cybersecurity, and IT management.

1

Create GDPR requirements dictionary

Create a dictionary called gdpr_requirements with these exact entries: 'Lawfulness, fairness and transparency' with value 'Process data legally and fairly', 'Purpose limitation' with value 'Collect data for specified purposes only', 'Data minimization' with value 'Only collect necessary data', 'Consent' with value 'Obtain clear consent from individuals', and 'Data subject rights' with value 'Allow individuals to access and control their data'.

Cybersecurity

# Create the gdpr_requirements dictionary with exact keys and values
# Your code here

Hint

Use curly braces {} to create the dictionary and separate each key-value pair with a comma.

2

Add count of GDPR requirements

Create a variable called requirement_count and set it to the number of items in the gdpr_requirements dictionary.

Cybersecurity

gdpr_requirements = {
    'Lawfulness, fairness and transparency': 'Process data legally and fairly',
    'Purpose limitation': 'Collect data for specified purposes only',
    'Data minimization': 'Only collect necessary data',
    'Consent': 'Obtain clear consent from individuals',
    'Data subject rights': 'Allow individuals to access and control their data'
}
# Create requirement_count to hold the number of GDPR requirements
# Your code here

Hint

Use the len() function to count items in the dictionary.

3

Filter requirements mentioning consent

Create a new dictionary called consent_requirements that includes only the entries from gdpr_requirements where the description contains the word 'consent'. Use a for loop with variables key and value to iterate over gdpr_requirements.items().

Cybersecurity

for key, value in gdpr_requirements.items():
    if 'consent' in value:
        consent_requirements[key] = value
# Create checklist_status with the confirmation message

Hint

Check if the word 'consent' is in the description string using the in keyword inside the loop.

4

Add final confirmation statement

Create a variable called checklist_status and set it to the string 'GDPR checklist is ready' to confirm the checklist is complete.

Cybersecurity

checklist_status = 'GDPR checklist is ready'

Hint

Assign the exact string to the variable as shown.

Practice

1. What is the main purpose of the GDPR?

easy

A. To protect personal data and privacy of individuals

B. To regulate financial transactions in the EU

C. To control internet speeds across countries

D. To manage copyright laws for digital content

Solution

1. Step 1: Understand GDPR's focus

   GDPR stands for General Data Protection Regulation, which is designed to protect personal data and privacy.

2. Step 2: Eliminate unrelated options

   Options about financial transactions, internet speeds, and copyright laws are unrelated to GDPR's main goal.

3. Final Answer:

   To protect personal data and privacy of individuals -> Option A

4. Quick Check:

   GDPR = Protect personal data [OK]

Hint: GDPR always relates to personal data protection [OK]

Common Mistakes:

• Confusing GDPR with financial or internet regulations
• Thinking GDPR controls internet speed
• Mixing GDPR with copyright laws

2. Which of the following is a GDPR requirement for collecting personal data?

easy

A. Collect data without informing the user

B. Share data freely with third parties

C. Store data indefinitely without limits

D. Obtain clear and explicit consent from the user

Solution

1. Step 1: Identify GDPR's consent rule

   GDPR requires that organizations get clear and explicit consent before collecting personal data.

2. Step 2: Check other options for GDPR compliance

   Collecting data without informing, storing indefinitely, or sharing freely violate GDPR rules.

3. Final Answer:

   Obtain clear and explicit consent from the user -> Option D

4. Quick Check:

   Consent needed before data collection [OK]

Hint: Consent is mandatory before collecting personal data [OK]

Common Mistakes:

• Assuming data can be collected silently
• Believing data can be stored forever
• Thinking data can be shared without restrictions

3. Consider this code snippet representing a data request under GDPR:

request = {"user_id": 123, "consent": True, "data": "email"}
if request["consent"]:
    print("Data can be processed")
else:
    print("Consent required")

What will be the output?

medium

A. Consent required

B. Data can be processed

C. Error: KeyError

D. No output

Solution

1. Step 1: Check the consent value in the request

   The key "consent" has the value True, meaning consent is given.

2. Step 2: Follow the if condition logic

   Since consent is True, the code prints "Data can be processed".

3. Final Answer:

   Data can be processed -> Option B

4. Quick Check:

   Consent True means process data [OK]

Hint: True consent prints 'Data can be processed' [OK]

Common Mistakes:

• Assuming consent is False by default
• Expecting a KeyError due to missing keys
• Thinking no output occurs

4. A company stores personal data without a clear retention policy. Which GDPR principle is violated?

medium

A. Lawfulness of processing

B. Data minimization

C. Storage limitation

D. Data portability

Solution

1. Step 1: Understand storage limitation principle

   GDPR requires personal data to be kept only as long as necessary, which is storage limitation.

2. Step 2: Match the violation to the principle

   Storing data without a retention policy means no limit on storage time, violating storage limitation.

3. Final Answer:

   Storage limitation -> Option C

4. Quick Check:

   Unlimited storage breaks storage limitation [OK]

Hint: No retention policy breaks storage limitation rule [OK]

Common Mistakes:

• Confusing data minimization with storage limits
• Thinking lawfulness covers storage duration
• Mixing data portability with storage rules

5. A company wants to use customer data for marketing but only has implied consent from website visits. According to GDPR, what should the company do?

hard

A. Obtain explicit consent before using data for marketing

B. Use the data freely since the customer visited the site

C. Assume consent if the customer did not opt out

D. Share data with partners without informing customers

Solution

1. Step 1: Identify consent type needed for marketing

   GDPR requires explicit consent for using personal data in marketing, not implied or assumed consent.

2. Step 2: Determine correct action

   The company must get clear, explicit consent before using data for marketing purposes.

3. Final Answer:

   Obtain explicit consent before using data for marketing -> Option A

4. Quick Check:

   Marketing needs explicit consent [OK]

Hint: Marketing always requires explicit consent under GDPR [OK]

Common Mistakes:

• Assuming visiting a site equals consent
• Thinking opt-out is enough for consent
• Ignoring the need to inform customers