Fiche 13/54 Part I — General Introduction Intermediate Reviewed 2026-08-23

Part 1 Review & Transition to Part 2

Part 1 established the baseline vocabulary and operational boundaries of the GDPR. You now master data qualification, territorial reach, and stakeholder roles. These foundations prepare you to address

Open in interactive reader

🎯 Module 1 Synthesis ⚖️ Gateway to Article 5

Part 1 Review & Transition to Part 2

⚡ In 30 seconds

Part 1 established the regulatory perimeter: what constitutes personal data (Art. 4.1), the wide umbrella of processing (Art. 4.2), the stringent boundaries of sensitive data (Art. 9), extraterritorial jurisdiction (Art. 3), and the distinction between Controllers and Processors. Part 2 will explore the 6 cardinal processing principles of Article 5 and Accountability.

Mastered in Part 1

• Scope & definitions (Art. 2–4)
• Anonymous vs Pseudonymous vs Sensitive
• Risk-based approach & DPIA triggers
• Controller / Processor boundaries (Art. 4.7/4.8)

Coming in Part 2 (Principles)

• Lawfulness, fairness, and transparency
• Purpose limitation & data minimisation
• Accuracy & storage limitation
• Accountability as an evidentiary burden

⚡ Key Takeaways

Qualification is the prerequisite before assessing lawfulness under Article 6.
Without personal data, GDPR obligations do not arise.
Part 2 shifts from 'what is covered' to 'how data must be handled'.

⚠️ Common Pitfall

Attempting to implement data minimisation or retention rules without first categorising data types and system roles.

🛠️ In Practice

Keep your data inventory up to date as the foundational reference before proceeding to the principles of Part 2.

⚖️ Official Sources: Articles 1 to 10 GDPR · Recitals 1 to 56 ✓ Legal review: 23 August 2026