Data privacy and compliance (GDPR) in HLD - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the GDPR principle that requires data to be accurate and up to date.

HLD

The GDPR principle of [1] mandates that personal data must be accurate and kept up to date.

Drag options to blanks, or click blank then click option'

AIntegrity and Confidentiality

BAccuracy

CStorage Limitation

DData Minimization

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing data accuracy with data minimization.

The Accuracy principle requires that personal data is accurate and kept up to date.

2fill in blank

medium

Complete the code to specify the GDPR right that allows users to request deletion of their data.

HLD

Under GDPR, the right to [1] allows individuals to have their personal data erased.

Drag options to blanks, or click blank then click option'

ARight to be Forgotten

BRight to Access

CData Portability

DData Minimization

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up with right to access or data portability.

The Right to be Forgotten allows individuals to request deletion of their personal data.

3fill in blank

hard

Fix the error in the GDPR compliance step related to data processing consent.

HLD

Before processing personal data, the system must obtain [1] from the user.

Drag options to blanks, or click blank then click option'

Anotification

Banonymization

Cencryption

Dconsent

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing consent with notification or security measures.

GDPR requires explicit consent from users before processing their personal data.

4fill in blank

hard

Fill both blanks to complete the GDPR data processing principles in the system design.

HLD

The system must ensure data is [1] and processed [2] for specified purposes only.

Drag options to blanks, or click blank then click option'

Aaccurate

Bencrypted

Clawfully

Dminimized

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing encryption instead of lawful processing.

GDPR requires data to be accurate and processed lawfully for specific purposes.

5fill in blank

hard

Fill all three blanks to complete the GDPR compliance checklist for data storage.

HLD

Data must be stored with [1] to prevent breaches, kept only as long as [2], and users must have [3] to access their data.

Drag options to blanks, or click blank then click option'

Aanonymization

Bnecessary

Cright

Dencryption

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing anonymization with encryption or misunderstanding user rights.

Data should be stored with encryption, kept only as long as necessary, and users have the right to access their data.

Practice

1. What is the main purpose of GDPR in system design?

easy

A. To reduce server costs by deleting all user data immediately

B. To protect user privacy and ensure data is handled responsibly

C. To allow unlimited data collection for marketing

D. To increase system performance by caching user data

Solution

1. Step 1: Understand GDPR's goal

   GDPR aims to protect personal data and privacy of users in the EU.

2. Step 2: Match purpose to options

   Only To protect user privacy and ensure data is handled responsibly mentions protecting privacy and responsible data handling, which aligns with GDPR.

3. Final Answer:

   To protect user privacy and ensure data is handled responsibly -> Option B

4. Quick Check:

   GDPR = Protect privacy [OK]

Hint: GDPR = user privacy protection [OK]

Common Mistakes:

• Confusing GDPR with performance or cost goals
• Thinking GDPR allows unlimited data collection
• Ignoring privacy as the core focus

2. Which of the following is a correct way to obtain user consent under GDPR?

easy

A. Collecting data first, then asking for consent later

B. Pre-checked boxes that users can uncheck anytime

C. Assuming consent if the user visits the website

D. Clear opt-in with explicit user action before data collection

Solution

1. Step 1: Review GDPR consent rules

   Consent must be freely given, specific, informed, and unambiguous with clear user action.

2. Step 2: Evaluate options

   Only Clear opt-in with explicit user action before data collection describes explicit opt-in before data collection, which is GDPR compliant.

3. Final Answer:

   Clear opt-in with explicit user action before data collection -> Option D

4. Quick Check:

   Consent = explicit opt-in [OK]

Hint: Consent requires clear opt-in, not assumptions [OK]

Common Mistakes:

• Using pre-checked boxes as valid consent
• Assuming visiting equals consent
• Collecting data before consent

3. Consider a system that stores user data with a 'right to be forgotten' feature. Which action correctly implements this under GDPR?

def delete_user_data(user_id):
    # Step 1: Mark user data as deleted
    database.mark_deleted(user_id)
    # Step 2: Remove data from active systems
    cache.remove(user_id)
    # Step 3: Permanently erase data after retention period
    schedule_permanent_delete(user_id, days=30)

medium

A. This implementation violates GDPR because data is not deleted immediately

B. This implementation is incorrect because it does not notify the user

C. This implementation respects GDPR by delaying permanent deletion for 30 days

D. This implementation is incorrect because it does not encrypt user data

Solution

1. Step 1: Understand GDPR's 'right to be forgotten'

   GDPR allows data to be deleted but permits a retention period for legal or operational reasons.

2. Step 2: Analyze code steps

   Data is marked deleted, removed from active use, and scheduled for permanent erase after 30 days, which is acceptable.

3. Final Answer:

   This implementation respects GDPR by delaying permanent deletion for 30 days -> Option C

4. Quick Check:

   Right to be forgotten allows retention delay [OK]

Hint: Deletion can be delayed for legal retention [OK]

Common Mistakes:

• Expecting immediate permanent deletion always
• Confusing notification with deletion requirements
• Thinking encryption replaces deletion

4. A system logs user IP addresses without anonymization. Which GDPR compliance issue does this cause?

log_user_access(user_id, ip_address):
    logs.save({'user': user_id, 'ip': ip_address, 'time': now()})

medium

A. It violates data minimization by storing unnecessary personal data

B. It violates consent because IP addresses are not encrypted

C. It violates breach notification rules by logging IPs

D. It violates data portability by not exporting IP addresses

Solution

1. Step 1: Identify GDPR principles involved

   Data minimization requires only collecting data necessary for the purpose.

2. Step 2: Analyze IP logging

   Storing full IP addresses without anonymization may be unnecessary and excessive, violating minimization.

3. Final Answer:

   It violates data minimization by storing unnecessary personal data -> Option A

4. Quick Check:

   Data minimization = minimal necessary data [OK]

Hint: Store only data you really need [OK]

Common Mistakes:

• Confusing encryption with consent
• Mixing breach notification with logging
• Thinking data portability applies here

5. You are designing a system to comply with GDPR. Which combination of features best supports compliance?

• 1. Data encryption at rest and in transit
• 2. User consent management with audit logs
• 3. Automatic data deletion after user request
• 4. Collecting all user data for analytics without opt-out

hard

A. Features 1, 2, and 3 only

B. Features 2 and 4 only

C. Features 1 and 4 only

D. All features 1, 2, 3, and 4

Solution

1. Step 1: Evaluate each feature for GDPR compliance

   Feature 1 (encryption) protects data; Feature 2 manages consent properly; Feature 3 respects user deletion rights; Feature 4 violates consent and data minimization.

2. Step 2: Select compliant combination

   Only features 1, 2, and 3 together support GDPR compliance fully.

3. Final Answer:

   Features 1, 2, and 3 only -> Option A

4. Quick Check:

   Consent + encryption + deletion = GDPR compliance [OK]

Hint: Exclude features violating consent or data minimization [OK]

Common Mistakes:

• Including data collection without opt-out
• Ignoring encryption importance
• Overlooking user deletion rights