Data privacy and compliance (GDPR) in HLD - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding GDPR Data Subject Rights

Which of the following is NOT a right granted to data subjects under GDPR?

A Right to demand unlimited data sharing with third parties

B Right to have personal data erased (right to be forgotten)

C Right to access personal data held by an organization

D Right to data portability to another service provider

💡 Hint

Think about what GDPR protects regarding personal data sharing.

GDPR does not grant the right to demand unlimited data sharing with third parties. Instead, it controls and restricts data sharing to protect privacy.

❓ Architecture

intermediate

Designing a GDPR-Compliant Data Deletion Flow

You need to design a system flow for handling user requests to delete their personal data under GDPR. Which step should NOT be part of the flow?

A Immediately delete all data without any backup or logs

B Log the deletion request and action for audit purposes

C Verify the identity of the requester before processing deletion

D Notify the user once deletion is complete

💡 Hint

Consider GDPR requirements for accountability and audit trails.

GDPR requires organizations to keep records of processing activities, including deletions, for accountability. Immediate deletion without logs breaks this rule.

❓ scaling

advanced

Scaling Data Access Requests in a Multi-Region System

Your global service receives thousands of GDPR data access requests daily from users in different regions. Which architectural approach best supports scalable, compliant handling of these requests?

A Centralize all personal data in one region and process all requests there

B Process requests manually via email to ensure accuracy

C Ignore regional data residency and process requests in any data center

D Distribute data regionally and process requests locally with synchronized audit logs

💡 Hint

Think about data residency laws and system scalability.

Distributing data regionally respects data residency laws and processing requests locally reduces latency and scales better. Synchronizing audit logs ensures compliance.

❓ tradeoff

advanced

Tradeoffs in Data Encryption for GDPR Compliance

When implementing encryption for personal data to comply with GDPR, which tradeoff is most important to consider?

A Not encrypting data to improve system performance

B Encrypting all data at rest and in transit may increase latency and cost

C Encrypting only non-personal data to save resources

D Using weak encryption algorithms to reduce complexity

💡 Hint

GDPR requires protection of personal data but also consider system impact.

Encrypting all personal data protects privacy but may increase latency and cost. Balancing security and performance is key.

❓ estimation

expert

Estimating Storage Needs for GDPR Data Retention

Your system stores personal data for 5 years to comply with GDPR retention policies. If you have 1 million users, each generating 10 KB of personal data monthly, estimate the total storage needed for personal data retention.

A 50 TB

B 5 TB

C 600 GB

D 600 TB

💡 Hint

Calculate monthly data per user, multiply by users and months in 5 years, then convert to TB.

Per month: 1,000,000 users × 10 KB = 10,000,000 KB ≈ 10 GB
Over 60 months: 10 GB × 60 = 600 GB