GDPR

What GDPR Is

GDPR is Regulation (EU) 2016/679. It governs the protection of personal data and the free movement of that data within the EU legal framework. It became applicable on 25 May 2018 and applies broadly to organizations that process personal data in scope, including some organizations established outside the EU.

What Counts as Personal Data

Personal data is any information relating to an identified or identifiable natural person. That can include obvious identifiers such as name, email address, ID number, and account identifiers, but it also includes indirect identifiers when they can reasonably be linked back to a person.

• Name, email address, phone number
• Customer IDs, employee IDs, IP addresses in relevant contexts
• Location data and online identifiers
• HR files, CRM records, medical or financial data tied to a person

When GDPR Applies

GDPR applies to organizations established in the EU when they process personal data in the context of those activities. It can also apply extraterritorially when an organization outside the EU offers goods or services to individuals in the EU or monitors their behavior.

Core GDPR Principles

GDPR is built around principles. In practice, these are the fastest way to reason through scenario questions because they explain whether the processing model itself is defective before you even get into controls.

• Lawfulness, fairness, and transparency: process data on a valid legal basis and communicate clearly.
• Purpose limitation: collect data for specified, explicit purposes and do not drift into unrelated reuse.
• Data minimization: collect only what is necessary.
• Accuracy: keep data correct and updated where needed.
• Storage limitation: do not retain data longer than necessary.
• Integrity and confidentiality: secure the data appropriately.
• Accountability: be able to demonstrate compliance, not just claim it.

Lawful Bases for Processing

Processing must rest on a lawful basis. CISSP candidates do not need to behave like privacy counsel, but they do need to understand that consent is only one basis and often not the strongest one in enterprise contexts.

• Consent
• Contract
• Legal obligation
• Vital interests
• Public task
• Legitimate interests

Rights of the Data Subject

GDPR gives individuals enforceable rights over their personal data. These rights drive design, process, retention, logging, discovery, and incident workflows.

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure in relevant circumstances
• Right to restrict processing
• Right to data portability
• Right to object
• Rights related to automated decision-making and profiling

Controllers, Processors, and Accountability

A controller decides the purposes and means of processing. A processor handles personal data on behalf of a controller. This distinction matters because obligations differ, contracts matter, and responsibility cannot be hand-waved away just because processing is outsourced.

Controller Responsibilities

• Define lawful basis and purpose
• Provide notices and honor rights requests
• Select processors with sufficient guarantees
• Implement appropriate technical and organizational measures
• Demonstrate accountability

Processor Responsibilities

• Process only on documented instructions
• Support security and confidentiality
• Assist with compliance obligations where applicable
• Use sub-processors appropriately under required controls

Data Protection by Design and by Default

GDPR expects privacy to be engineered into systems and processes. This is where privacy architecture, minimization, access control, segregation, retention logic, and default settings become operational—not decorative.

DPIA and High-Risk Processing

Where processing is likely to result in a high risk to the rights and freedoms of natural persons, a Data Protection Impact Assessment may be required. The goal is structured risk evaluation before the organization scales the processing activity.

• Understand origin, nature, scope, context, and purposes
• Assess risk severity and likelihood
• Define measures to mitigate risk
• Document decisions and rationale

Security of Processing

GDPR does not prescribe a single checklist for all organizations. It requires appropriate technical and organizational measures based on risk, costs, state of the art, and the nature of the data involved.

• Encryption and pseudonymization where appropriate
• Access control and least privilege
• Confidentiality, integrity, availability, and resilience
• Restore capability after incidents
• Regular testing and evaluation of security measures

International Data Transfers

GDPR does not allow uncontrolled transfers of personal data to third countries. Transfers need an approved mechanism or legal basis, such as adequacy decisions, Standard Contractual Clauses (SCCs), or Binding Corporate Rules (BCRs) in the relevant circumstances.

Personal Data Breach Handling

A personal data breach is not limited to disclosure. It can involve destruction, loss, alteration, unauthorized disclosure of, or access to personal data. That maps directly back to CIA thinking.

• Contain and investigate quickly
• Assess whether the breach creates risk to individuals
• Notify the supervisory authority when required
• Notify affected individuals when the risk threshold is high enough
• Document the breach and the response

DPO and Governance Structure

Some organizations are required to appoint a Data Protection Officer depending on their activities. Even where not mandatory, privacy accountability still requires defined ownership, reporting lines, policies, training, records, and escalation logic.

What CISSP Candidates Should Remember

• GDPR is principle-driven, not just form-driven.
• Privacy is a governance and system-design problem, not only a legal paperwork problem.
• Data minimization and storage limitation are major control themes.
• Cross-border transfers require structured safeguards.
• Breach handling includes more than confidentiality loss.
• Accountability means evidence, not verbal assurance.