GDPR requirements in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does GDPR stand for?

GDPR stands for General Data Protection Regulation. It is a law that protects people's personal data in the European Union.

beginner

What is the main purpose of GDPR?

The main purpose of GDPR is to give people control over their personal data and to make organizations responsible for protecting that data.

intermediate

Name two key rights GDPR gives to individuals.

1. The right to access their personal data.<br>2. The right to have their data deleted (right to be forgotten).

beginner

What must organizations do before collecting personal data under GDPR?

Organizations must ensure they have a lawful basis, such as clear and informed consent, before collecting personal data.

intermediate

What should an organization do if it suffers a data breach under GDPR?

They must notify the relevant data protection authority within 72 hours and inform affected individuals if there is a high risk to their rights.

What is the maximum time allowed to report a data breach under GDPR?

A 24 hours

B 72 hours

C 1 week

D 1 month

GDPR requires organizations to report data breaches within 72 hours of becoming aware of them.

Which of the following is NOT a right under GDPR?

A Right to unlimited data collection

B Right to be forgotten

C Right to access personal data

D Right to data portability

GDPR does not allow unlimited data collection; it requires data minimization and consent.

Who does GDPR apply to?

A Only government agencies

B Only companies inside the EU

C Any organization processing EU residents' personal data

D Only companies with more than 100 employees

GDPR applies to any organization worldwide that processes personal data of people living in the EU.

What is required for lawful processing of personal data under GDPR?

A Clear consent or another legal basis

B No consent needed

C Only verbal agreement

D Processing without informing individuals

GDPR requires clear consent or another legal basis like contract or legal obligation for processing data.

What does the 'right to be forgotten' allow individuals to do?

A Access someone else's data

B Change their personal data without proof

C Stop all emails from any company

D Request deletion of their personal data

The right to be forgotten lets individuals ask organizations to delete their personal data under certain conditions.

Explain the main responsibilities organizations have under GDPR when handling personal data.

Think about what organizations must do before, during, and after collecting data.

Describe the rights GDPR gives to individuals regarding their personal data.

Focus on what people can ask organizations to do with their data.