Data privacy and compliance (GDPR) in HLD - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is GDPR and why is it important in system design?

GDPR stands for General Data Protection Regulation. It is a law that protects personal data of people in the EU. In system design, it ensures that user data is handled safely and with respect to privacy.

intermediate

Name three key principles of GDPR that affect system architecture.

1. Data Minimization: Only collect data needed.<br>2. Purpose Limitation: Use data only for stated reasons.<br>3. Data Subject Rights: Allow users to access, correct, or delete their data.

beginner

What is 'data subject consent' and how should systems handle it?

Data subject consent means users agree clearly to how their data is used. Systems must get explicit permission before collecting data and allow users to withdraw consent anytime.

intermediate

Explain the concept of 'data breach notification' under GDPR.

If personal data is leaked or accessed wrongly, GDPR requires notifying authorities within 72 hours and informing affected users quickly to reduce harm.

advanced

How can system design support the 'right to be forgotten'?

Systems should allow users to request deletion of their personal data. This means designing data storage and backups so data can be fully removed without breaking the system.

Which of the following is NOT a GDPR principle?

A Data Minimization

B Unlimited Data Retention

C Purpose Limitation

D Data Subject Rights

GDPR requires limiting how long data is kept, so unlimited retention is not allowed.

Under GDPR, how soon must a data breach be reported to authorities?

A Within 72 hours

B Within 24 hours

C Within 1 week

D No specific time

GDPR mandates reporting data breaches within 72 hours of discovery.

What does 'data subject consent' require?

A No consent needed for personal data

B Implicit agreement by using the service

C Explicit and informed permission before data collection

D Consent only for marketing emails

GDPR requires clear, explicit consent before collecting personal data.

Which system design feature helps support the 'right to be forgotten'?

A Data encryption

B Data anonymization

C Data replication

D Data deletion mechanisms

Systems must allow complete deletion of user data to comply with this right.

What is the main goal of GDPR in system design?

A Protect user privacy and data rights

B Maximize data collection

C Increase system speed

D Reduce server costs

GDPR focuses on protecting personal data and respecting user privacy.

Describe how GDPR principles influence the design of a user data storage system.

Think about what data you keep, how you get permission, and how users can control their data.

Explain the steps a system should take when a data breach occurs under GDPR.

Consider detection, communication, and prevention.