GDPR Compliance Fiches
Part I — General Introduction
- 1 Interactive Summary & GDPR Study Guide
- 2 Objectives of the Regulation & Societal Stakes
- 3 Regulation (EU) 2016/679 & European Historical Context
- 4 Scope of Application: Material & Territorial (Art. 2 & 3)
- 5 What is Personal Data? (Art. 4.1)
- 6 Data Typology: Anonymous vs Pseudonymous vs Sensitive Data
- 7 Special Categories of Data (Art. 9) & Criminal Offences (Art. 10)
- 8 The Concept of Processing (Art. 4.2)
- 9 Compatibility of Further Purposes (Art. 6.4)
- 10 The Risk-Based Approach
- 11 Legal Qualification Decision Tree
- 12 Practical Case Study: Ecosystem Qualification
- 13 Part 1 Review & Transition to Part 2
Part 2 — Core Principles
- 14 The 6 Cardinal Principles of Processing (Art. 5.1)
- 15 Data Minimisation (Art. 5.1.c)
- 16 Anonymisation vs Pseudonymisation (Art. 4.5)
- 17 Principle of Accuracy (Art. 5.1.d)
- 18 Storage Limitation (Art. 5.1.e)
- 19 Key Stakeholders: Controller vs Processor (Art. 4.7, 4.8)
- 20 Accountability & Proactive Responsibility (Art. 5.2 & 24)
- 21 Synthesis: Principles Audit Matrix
Part 3 — Lawfulness & Key Actors
- 22 The 6 Legal Bases for Processing (Art. 6.1)
- 23 Consent Regime & Validity Standards (Art. 4.11 & 7)
- 24 ePrivacy Directive, Cookies & Consent Platforms (CMPs)
- 25 Controller Obligations & Joint Controllership (Art. 24 & 26)
- 26 Subcontracting & Data Processing Agreements (Art. 28)
- 27 International Data Transfers Outside the EU (Chapter V)
- 28 Legitimate Interests & The Balancing Test (LIA) (Art. 6.1.f)
- 29 Supervisory Authorities, One-Stop-Shop & EDPB (Art. 51–76)
- 30 Synthesis: Contractual Compliance & Lawfulness Checklist
Part 4 — Data Subject Rights
- 31 General Modalities for the Exercise of Rights (Art. 12)
- 32 Right to Information & Transparency (Art. 13 & 14)
- 33 Right of Access & The Notion of Copy (Art. 15)
- 34 Right to Rectification & Third-Party Notification (Art. 16 & 19)
- 35 Right to Erasure ('Right to be Forgotten') (Art. 17)
- 36 Right to Restriction of Processing (Art. 18)
- 37 Right to Data Portability (Art. 20)
- 38 Right to Object & Direct Marketing (Art. 21)
- 39 Automated Individual Decisions & Profiling (Art. 22)
- 40 Operational Workflow: Subject Rights Requests Management
Part 5 — Operational Obligations & Sanctions
- 41 Data Protection by Design & by Default (Art. 25)
- 42 Record of Processing Activities (RoPA) (Art. 30)
- 43 Data Protection Impact Assessment (DPIA) (Art. 35)
- 44 Data Protection Officer (DPO) (Art. 37–39)
- 45 Security of Processing: Technical Measures (Art. 32)
- 46 Security of Processing: Organizational Measures (Art. 32)
- 47 Personal Data Breaches: Notification Procedure (Art. 33 & 34)
- 48 Codes of Conduct & Certifications (Art. 40-43)
- 49 Compliance Audit & Continuous Action Plan
- 50 Powers of Supervisory Authorities (Art. 58)
- 51 Administrative Fines & Sanctions (Art. 83)
- 52 Civil Liability & Right to Compensation (Art. 82)
- 53 Key European Case Law & Rulings
- 54 Documented Compliance Roadmap