Learn GDPR engineering vocabulary: right to erasure across all systems including backups, data portability API, DPA breach notification within 72 hours, pseudonymisation vs. anonymisation — for privacy-compliant engineering.
0 / 21 completed
1 / 21
The privacy engineer explains: 'The right to erasure requires deleting PII from all systems, including backups.' Why is 'including backups' significant?
GDPR's right to erasure (also called the 'right to be forgotten') requires organisations to delete a data subject's personal data upon request, where no other legal basis for retention exists. Critically, this applies across all systems where the data is stored — including database backups, data warehouse snapshots, log archives, and analytics pipelines. Engineering erasure that covers backups is technically challenging but legally required.
2 / 21
The backend developer says: 'The data portability API returns all user data in a structured, machine-readable format.' What GDPR right does this implement?
GDPR Article 20 grants the right to data portability: users can request a copy of their personal data in a structured, commonly-used, machine-readable format (such as JSON or CSV). They can also request that this data be transmitted directly to another data controller. Engineering a data portability API that generates a complete, accurate export of a user's data is a common GDPR compliance task.
3 / 21
The incident response plan states: 'The DPA must be notified within 72 hours of a breach.' What does this mean?
GDPR Article 33 requires organisations to notify their supervisory authority (the Data Protection Authority, or DPA, in the relevant EU member state) within 72 hours of becoming aware of a personal data breach — unless the breach is unlikely to result in a risk to individuals. This 72-hour clock starts from awareness, not discovery. If notification cannot be made within 72 hours, a partial notification must be sent with an explanation of the delay.
4 / 21
The data architect asks: 'Are we using pseudonymisation or anonymisation for this analytics dataset?' What is the key difference?
Pseudonymisation replaces direct identifiers (like name or email) with a pseudonym (e.g., a random UUID), but the mapping between pseudonym and real identity is stored separately. If someone has the key, they can re-identify the data — so pseudonymised data is still personal data under GDPR. Anonymisation irreversibly removes the ability to identify individuals; truly anonymised data is outside GDPR's scope. Most 'anonymised' analytics data is actually pseudonymised.
5 / 21
The privacy review comment reads: 'This feature stores user location history — we need a lawful basis for processing.' What is a 'lawful basis for processing' under GDPR?
Under GDPR Article 6, every act of processing personal data must have a lawful basis. The six lawful bases are: (1) consent, (2) contract (processing necessary to fulfil a contract with the user), (3) legal obligation, (4) vital interests, (5) public task, and (6) legitimate interests. Organisations must identify and document the lawful basis before processing personal data. Without a lawful basis, the processing is unlawful under GDPR.
6 / 21
PR Description
Subject: API Integration - User Profile Updates
We've integrated the new user profile update API. The response includes a field called `consent_flags` which is a boolean indicating whether the user has consented to specific data processing activities (e.g., marketing emails, analytics tracking). This allows us to accurately reflect and enforce user preferences as mandated by GDPR.
Which of the following best describes the purpose of the consent_flags field in this context?
The question requires understanding how consent_flags relate to GDPR. The correct answer highlights that this field specifically represents the user's explicit permission – a core concept of consent management under GDPR. Options A and D are misinterpretations; A focuses on technical identifiers, while D is irrelevant to the scenario. Option B is partially accurate but doesn't fully capture the nuanced requirement for *specific* processing activities being consented to.
7 / 21
Code Review Comment
During a code review of the user profile update API integration, your team lead comments: 'This consent_flags field is key to GDPR compliance. We need to track which data processing activities users have explicitly agreed to.'
Which of the following best describes the role of this consent_flags field within the API response and its importance for meeting GDPR requirements?
The correct answer highlights the field's purpose of tracking granular consent – specifically, which *data processing activities* (like marketing emails or analytics) the user has consented to. This is crucial because GDPR emphasizes individual control over data and allows users to opt-out of specific types of processing. The other options misunderstand the core principle: simply having a 'yes/no' consent flag isn't enough; you need to track *what* consent was given for.
8 / 21
You're reviewing a Slack message from the frontend team regarding a new feature that allows users to opt out of personalized recommendations. The message states: 'We've added a `opt_out` boolean flag to the user profile API response. If it's true, we don't show them any recommendations.' A senior engineer asks: 'How does this integration ensure we comply with GDPR's right to object – specifically, the user's ability to prevent processing based on profiling?'
This is correct because setting the `opt_out` flag in the API response triggers a backend process to *prevent* personalized recommendations. GDPR's right to object (Article 21) allows users to stop profiling and therefore receiving tailored suggestions. Options A and D are incorrect as they misrepresent the level of action taken; Option B is insufficient because it places responsibility solely on the backend, without guaranteeing the user's rights are upheld. Option C correctly states that this directly fulfills the right to object.
9 / 21
PR Description
Subject: API Integration - User Profile Updates
We've integrated the new user profile update API. The response includes a field called `consent_flags` which is a boolean indicating whether the user has consented to specific data processing activities (e.g., marketing emails, analytics tracking). This allows us to accurately reflect and enforce user preferences as mandated by GDPR.
Which of the following best describes the purpose of the consent_flags field in this context?
The question requires understanding how consent_flags relate to GDPR. The correct answer highlights that this field specifically represents the user's explicit permission – a core concept of consent management under GDPR. Options A and D are misinterpretations; A focuses on technical identifiers, while D is irrelevant to the scenario. Option B is partially accurate but doesn't fully capture the nuanced requirement for *specific* processing activities being consented to.
10 / 21
Code Review Comment
During a code review of the user profile update API integration, your team lead comments: 'This consent_flags field is key to GDPR compliance. We need to track which data processing activities users have explicitly agreed to.'
Which of the following best describes the role of this consent_flags field within the API response and its importance for meeting GDPR requirements?
The correct answer highlights the field's purpose of tracking granular consent – specifically, which *data processing activities* (like marketing emails or analytics) the user has consented to. This is crucial because GDPR emphasizes individual control over data and allows users to opt-out of specific types of processing. The other options misunderstand the core principle: simply having a 'yes/no' consent flag isn't enough; you need to track *what* consent was given for.
11 / 21
You're reviewing a Slack message from the frontend team regarding a new feature that allows users to opt out of personalized recommendations. The message states: 'We've added a `opt_out` boolean flag to the user profile API response. If it's true, we don't show them any recommendations.' A senior engineer asks: 'How does this integration ensure we comply with GDPR's right to object – specifically, the user's ability to prevent processing based on profiling?'
This is correct because setting the `opt_out` flag in the API response triggers a backend process to *prevent* personalized recommendations. GDPR's right to object (Article 21) allows users to stop profiling and therefore receiving tailored suggestions. Options A and D are incorrect as they misrepresent the level of action taken; Option B is insufficient because it places responsibility solely on the backend, without guaranteeing the user's rights are upheld. Option C correctly states that this directly fulfills the right to object.
12 / 21
PR Description
Subject: API Integration - User Profile Updates
We've integrated the new user profile update API. The response includes a field called `consent_flags` which is a boolean indicating whether the user has consented to specific data processing activities (e.g., marketing emails, analytics tracking). This allows us to accurately reflect and enforce user preferences as mandated by GDPR.
Which of the following best describes the purpose of the consent_flags field in this context?
The question requires understanding how consent_flags relate to GDPR. The correct answer highlights that this field specifically represents the user's explicit permission – a core concept of consent management under GDPR. Options A and D are misinterpretations; A focuses on technical identifiers, while D is irrelevant to the scenario. Option B is partially accurate but doesn't fully capture the nuanced requirement for *specific* processing activities being consented to.
13 / 21
Code Review Comment
During a code review of the user profile update API integration, your team lead comments: 'This consent_flags field is key to GDPR compliance. We need to track which data processing activities users have explicitly agreed to.'
Which of the following best describes the role of this consent_flags field within the API response and its importance for meeting GDPR requirements?
The correct answer highlights the field's purpose of tracking granular consent – specifically, which *data processing activities* (like marketing emails or analytics) the user has consented to. This is crucial because GDPR emphasizes individual control over data and allows users to opt-out of specific types of processing. The other options misunderstand the core principle: simply having a 'yes/no' consent flag isn't enough; you need to track *what* consent was given for.
14 / 21
You're reviewing a Slack message from the frontend team regarding a new feature that allows users to opt out of personalized recommendations. The message states: 'We've added a `opt_out` boolean flag to the user profile API response. If it's true, we don't show them any recommendations.' A senior engineer asks: 'How does this integration ensure we comply with GDPR's right to object – specifically, the user's ability to prevent processing based on profiling?'
This is correct because setting the `opt_out` flag in the API response triggers a backend process to *prevent* personalized recommendations. GDPR's right to object (Article 21) allows users to stop profiling and therefore receiving tailored suggestions. Options A and D are incorrect as they misrepresent the level of action taken; Option B is insufficient because it places responsibility solely on the backend, without guaranteeing the user's rights are upheld. Option C correctly states that this directly fulfills the right to object.
15 / 21
PR Description
Subject: API Integration - User Profile Updates
We've integrated the new user profile update API. The response includes a field called `consent_flags` which is a boolean indicating whether the user has consented to specific data processing activities (e.g., marketing emails, analytics tracking). This allows us to accurately reflect and enforce user preferences as mandated by GDPR.
Which of the following best describes the purpose of the consent_flags field in this context?
The question requires understanding how consent_flags relate to GDPR. The correct answer highlights that this field specifically represents the user's explicit permission – a core concept of consent management under GDPR. Options A and D are misinterpretations; A focuses on technical identifiers, while D is irrelevant to the scenario. Option B is partially accurate but doesn't fully capture the nuanced requirement for *specific* processing activities being consented to.
16 / 21
Code Review Comment
During a code review of the user profile update API integration, your team lead comments: 'This consent_flags field is key to GDPR compliance. We need to track which data processing activities users have explicitly agreed to.'
Which of the following best describes the role of this consent_flags field within the API response and its importance for meeting GDPR requirements?
The correct answer highlights the field's purpose of tracking granular consent – specifically, which *data processing activities* (like marketing emails or analytics) the user has consented to. This is crucial because GDPR emphasizes individual control over data and allows users to opt-out of specific types of processing. The other options misunderstand the core principle: simply having a 'yes/no' consent flag isn't enough; you need to track *what* consent was given for.
17 / 21
You're reviewing a Slack message from the frontend team regarding a new feature that allows users to opt out of personalized recommendations. The message states: 'We've added a `opt_out` boolean flag to the user profile API response. If it's true, we don't show them any recommendations.' A senior engineer asks: 'How does this integration ensure we comply with GDPR's right to object – specifically, the user's ability to prevent processing based on profiling?'
This is correct because setting the `opt_out` flag in the API response triggers a backend process to *prevent* personalized recommendations. GDPR's right to object (Article 21) allows users to stop profiling and therefore receiving tailored suggestions. Options A and D are incorrect as they misrepresent the level of action taken; Option B is insufficient because it places responsibility solely on the backend, without guaranteeing the user's rights are upheld. Option C correctly states that this directly fulfills the right to object.
18 / 21
During a code review of the user onboarding flow, Sarah (the senior engineer) comments: 'We're using `consent_flags` to manage user preferences. This is crucial for ensuring we're processing data with a valid legal basis – specifically, 'Consent'. What does 'Consent' mean in this context regarding GDPR implementation?
'Consent' in GDPR refers to the explicit agreement a user gives for their data to be processed. It's more than just informing them; it requires a clear and affirmative action demonstrating they understand how their data will be used. Options A and C misinterpret 'consent' as simply marketing tracking or merely notifying the user, respectively – both are insufficient under GDPR.
19 / 21
Mark from the backend team sends this Slack message: 'Just deployed the update to the user_profile API endpoint. We've added a field called `data_retention_period` which determines how long we store user data after they opt-out. It's a number in days.' What is the primary reason for including this data_retention_period field within the API response, relating to GDPR?
The data_retention_period field is essential for GDPR compliance. It's a practical implementation of the 'right to be forgotten' and allows us to limit data storage according to user opt-out preferences – directly linked to the legal basis (Consent or Restrictive Clauses) that governs their data processing. Option A incorrectly assumes automatic deletion; option C is correct but less specific, and option D is entirely inaccurate.
20 / 21
During the daily stand-up, David (the data engineer) says: 'We're implementing a new system to manage user consent. We'll be using a flag in the user_preferences table – let's call it `marketing_consent`. This will allow us to track whether users have opted into receiving promotional emails.' What is David primarily addressing regarding GDPR when describing this implementation?
David is directly addressing the core principle of GDPR regarding direct marketing. The marketing_consent flag represents a mechanism to record and manage user consent – specifically for activities that fall under 'direct marketing'. Option A focuses on database design; option B addresses anonymization (a separate concern); and option D negates the purpose of consent.
21 / 21
You are reviewing an API response from a service that handles user data. The response includes a field named `user_preferences`. Within this field, there is a boolean value called `marketing_consent`. What does this indicate in the context of GDPR?
The `marketing_consent` flag represents the *specific* permission a user has granted regarding marketing-related data processing. It's crucial to understand that consent needs to be granular – users can opt in or out of different types of communication and data usage, not simply accept all marketing activities. The system should only send communications if this flag is set to 'true', reflecting the user's choice.
What does the "GDPR Engineering Implementation Vocabulary" exercise practise?
Learn GDPR engineering vocabulary: right to erasure across all systems including backups, data portability API, DPA breach notification within 72 hours, pseudonymisation vs. anonymisation — for privacy-compliant engineering.
How many questions are in this exercise?
This exercise has 21 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Data Privacy category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "GDPR Engineering Implementation Vocabulary" part of a larger series?
Yes — it's one exercise in the Data Privacy category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Data Privacy category page for related exercises, or browse the main Exercises hub for other IT English topics.