Practice the key GDPR terms and data protection concepts that every developer working with European user data needs.
0 / 14 completed
1 / 14
Under GDPR, what is a Data Subject?
A data subject is the individual whose personal data is being processed — e.g., your users, employees, or customers.
2 / 14
What is the difference between a Data Controller and a Data Processor?
Controllers own the processing decision; processors act on the controller's instructions. Your company is typically a controller; AWS is a processor.
3 / 14
A user emails asking to delete all their data from your system. Under GDPR, what is this called?
The right to erasure (Article 17) allows individuals to request deletion of their personal data in certain circumstances.
4 / 14
You discover a breach that likely affected 500 users. Under GDPR, when must you notify the supervisory authority?
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
5 / 14
What does lawful basis for processing mean under GDPR?
Every processing activity must have one of 6 lawful bases under GDPR Article 6: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
6 / 14
PR Description
During code review, Sarah submitted a PR to update the user profile API. The description reads: 'Implemented new feature to store user's GDPR consent preferences. This will allow us to comply with data minimization principles and ensure we only retain data necessary for legitimate purposes.' Which of the following best describes the meaning of 'data minimization' in this context, as Sarah intends?
A. The API must be designed to handle a large volume of user data, anticipating future needs.
B. We should collect and retain only the absolute minimum amount of personal data required to fulfill the stated purpose – in this case, storing consent preferences – and no more.
C. All user profiles must include an optional field for users to specify their GDPR consent preferences, regardless of whether they actually have any.
D. The API should be designed to easily allow us to collect additional data about users later on if it becomes necessary.
'Data minimization' under GDPR refers to collecting and processing only the *necessary* personal data for a specific purpose. Option B correctly describes this principle: we should limit our collection to only what's required. Options A, C, and D illustrate potential misinterpretations – anticipating future needs doesn't justify excessive data collection, requiring an optional field isn't sufficient, and designing for later expansion is not the core of minimizing data. This concept directly relates to reducing privacy risks and complying with the 'data minimization' requirement.
7 / 14
PR Description
During code review, Sarah submitted a PR to update the user profile API. The description reads: 'Implemented new feature to store user's GDPR consent preferences. This will allow us to comply with data minimization principles and ensure we only retain data necessary for legitimate purposes.' Which of the following best describes the meaning of 'data minimization' in this context, as Sarah intends?
A. The API must be designed to handle a large volume of user data, anticipating future needs.
B. We should collect and retain only the absolute minimum amount of personal data required to fulfill the stated purpose – in this case, storing consent preferences – and no more.
C. All user profiles must include an optional field for users to specify their GDPR consent preferences, regardless of whether they actually have any.
D. The API should be designed to easily allow us to collect additional data about users later on if it becomes necessary.
'Data minimization' under GDPR refers to collecting and processing only the *necessary* personal data for a specific purpose. Option B correctly describes this principle: we should limit our collection to only what's required. Options A, C, and D illustrate potential misinterpretations – anticipating future needs doesn't justify excessive data collection, requiring an optional field isn't sufficient, and designing for later expansion is not the core of minimizing data. This concept directly relates to reducing privacy risks and complying with the 'data minimization' requirement.
8 / 14
PR Description
During code review, Sarah submitted a PR to update the user profile API. The description reads: 'Implemented new feature to store user's GDPR consent preferences. This will allow us to comply with data minimization principles and ensure we only retain data necessary for legitimate purposes.' Which of the following best describes the meaning of 'data minimization' in this context, as Sarah intends?
A. The API must be designed to handle a large volume of user data, anticipating future needs.
B. We should collect and retain only the absolute minimum amount of personal data required to fulfill the stated purpose – in this case, storing consent preferences – and no more.
C. All user profiles must include an optional field for users to specify their GDPR consent preferences, regardless of whether they actually have any.
D. The API should be designed to easily allow us to collect additional data about users later on if it becomes necessary.
'Data minimization' under GDPR refers to collecting and processing only the *necessary* personal data for a specific purpose. Option B correctly describes this principle: we should limit our collection to only what's required. Options A, C, and D illustrate potential misinterpretations – anticipating future needs doesn't justify excessive data collection, requiring an optional field isn't sufficient, and designing for later expansion is not the core of minimizing data. This concept directly relates to reducing privacy risks and complying with the 'data minimization' requirement.
9 / 14
PR Description
During code review, Sarah submitted a PR to update the user profile API. The description reads: 'Implemented new feature to store user's GDPR consent preferences. This will allow us to comply with data minimization principles and ensure we only retain data necessary for legitimate purposes.' Which of the following best describes the meaning of 'data minimization' in this context, as Sarah intends?
A. The API must be designed to handle a large volume of user data, anticipating future needs.
B. We should collect and retain only the absolute minimum amount of personal data required to fulfill the stated purpose – in this case, storing consent preferences – and no more.
C. All user profiles must include an optional field for users to specify their GDPR consent preferences, regardless of whether they actually have any.
D. The API should be designed to easily allow us to collect additional data about users later on if it becomes necessary.
'Data minimization' under GDPR refers to collecting and processing only the *necessary* personal data for a specific purpose. Option B correctly describes this principle: we should limit our collection to only what's required. Options A, C, and D illustrate potential misinterpretations – anticipating future needs doesn't justify excessive data collection, requiring an optional field isn't sufficient, and designing for later expansion is not the core of minimizing data. This concept directly relates to reducing privacy risks and complying with the 'data minimization' requirement.
10 / 14
David, a senior engineer, sends this Slack message: 'Just added a field to the user model to track GDPR consent. Seems like a good way to manage opt-ins and opt-outs.' Which of the following best describes why David is adding this field?
David's action is directly related to GDPR compliance. The field is designed to track and manage user consent—a core element of lawful processing under GDPR. Option A is incorrect because automatic compliance isn't possible; GDPR requires explicit consent. Options C and D are irrelevant to the legal basis for data collection.
11 / 14
During a code review, you're examining a change made by Maria that updates the user profile API. The commit message reads: 'Implemented GDPR data minimization techniques.' What does this term *primarily* refer to in the context of GDPR?
Data minimization is a key principle in GDPR. It mandates that organizations should only collect and process the minimum amount of personal data needed for the specified purpose. Option A is incorrect as it contradicts this principle. Options C and D are related to data security but not the core concept of minimizing data collection.
12 / 14
You're reviewing a PR description from Ben regarding a new feature that allows users to update their GDPR consent preferences. The description states: 'This change ensures we are adhering to the latest data protection standards.' What does 'adhering to the latest data protection standards' likely imply in this context?
'Adhering to the latest data protection standards' refers to staying current with GDPR. This means implementing the most recent version of the regulation and its interpretations as they evolve through guidance from supervisory authorities and legal developments. Options A, C and D are related but not the core meaning within this scenario.
13 / 14
Chloe reports a potential GDPR breach: it appears an unauthenticated user gained access to a database containing anonymized user data. The supervisory authority requires notification within 72 hours of discovery. According to GDPR, what is the *primary* reason for this immediate notification requirement?
The 72-hour notification requirement is driven by GDPR's emphasis on transparency and accountability. It's a crucial step to inform users about the breach, provide necessary support (e.g., credit monitoring), and allow the supervisory authority to investigate—all aimed at mitigating potential harm and fulfilling GDPR's duty of information.
14 / 14
Ethan is discussing the 'lawful basis for processing' data with a colleague. Which of the following statements *best* explains this concept under GDPR?
The 'lawful basis' is the legal reason why you are processing someone's personal data. GDPR mandates that you must have a valid justification—like consent, contract fulfillment, or legitimate interest—before collecting and using their information. Options A, C and D describe related concepts but don't define the core lawful basis.
What does the "GDPR Vocabulary for Engineers" exercise practise?
Practice the key GDPR terms and data protection concepts that every developer working with European user data needs.
How many questions are in this exercise?
This exercise has 14 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Compliance Security category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "GDPR Vocabulary for Engineers" part of a larger series?
Yes — it's one exercise in the Compliance Security category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Compliance Security category page for related exercises, or browse the main Exercises hub for other IT English topics.