Practise vocabulary for implementing GDPR requirements technically: data subject rights, lawful basis, DPAs, data transfers, and Article 30 records.
0 / 10 completed
1 / 10
Under GDPR, processing personal data requires a ___ — such as consent, legitimate interest, or contractual necessity.
GDPR Article 6 requires a lawful basis for processing personal data: consent, contract performance, legal obligation, vital interest, public task, or legitimate interest. Processing without a lawful basis is illegal.
2 / 10
A Data Processing Agreement (DPA) is a contract required when a ___ processes personal data on behalf of a controller.
A DPA (GDPR Article 28) governs the relationship between a data controller (the company) and a data processor (a vendor who processes data on their behalf, e.g., a cloud provider). It defines processing instructions, security measures, and subprocessor requirements.
3 / 10
GDPR's Article 30 requires organisations to maintain ___ of processing activities — a documented inventory of all personal data processing.
The Record of Processing Activities (ROPA) documents all processing activities: what data is collected, for what purpose, who it's shared with, and how long it's retained. It's a mandatory compliance document for GDPR accountability.
4 / 10
Transferring personal data to a country outside the EU/EEA requires appropriate ___ such as Standard Contractual Clauses (SCCs) or an adequacy decision.
GDPR Chapter V restricts international data transfers. Mechanisms include: adequacy decisions (UK, Canada, Japan), Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or certification mechanisms.
5 / 10
A ___ is the mandatory response to a data subject exercising their right of access — providing a copy of all personal data held about them.
A Data Subject Access Request (DSAR) entitles individuals to receive a copy of their personal data within 30 days (GDPR Article 15). Technically, this requires systems that can efficiently query and export all data for a given individual across all databases.
6 / 10
Alex from the Data Governance team just commented on your PR: 'This endpoint logs user IP addresses. Are you implementing appropriate anonymization techniques to comply with GDPR Article 9(2) regarding children's data?' What does Alex likely mean by 'anonymization techniques'?
Alex is referring to techniques that transform data while preserving its utility for analytics but preventing identification of individuals. Simply masking the data isn't sufficient; a true anonymization technique involves replacing it with an identifier that cannot be traced back to the original user, fulfilling GDPR's requirements regarding children's data and minimizing risk.
7 / 10
You're drafting a Slack message to your team about a potential breach: 'We received an alert indicating a possible GDPR incident – unauthorized access logs detected on the user profile database. We need to immediately investigate and document this according to Article 5(3) of GDPR.' What is Article 5(3) referring to?
Article 5(3) outlines the immediate notification obligations under GDPR. It mandates that organizations must promptly inform the appropriate supervisory authority (e.g., ICO in the UK) within the stipulated timeframe – typically 72 hours – following discovery of a personal data breach. Failure to do so can result in significant penalties.
8 / 10
You're reviewing an API response from a third-party service that handles user consent management: `{"status": "success", "data": {"consent_tokens": ["token123", "token456"]}}`. Regarding GDPR, what is the primary purpose of these consent_tokens?
Consent_tokens are crucial for GDPR compliance. They act as verifiable records of a user's expressed consent – digitally signed to guarantee authenticity and prevent tampering. This allows you to audit consent decisions and, importantly, enables users to easily revoke their consent according to their rights.
9 / 10
During a standup meeting, your team lead asks: 'What's the status on implementing GDPR-compliant data transfer mechanisms for our European users?' What does he likely want you to explain?
Your team lead is concerned with ensuring lawful data transfer under GDPR. The core issue is that transferring personal data outside the EU/EEA requires specific safeguards – primarily Standard Contractual Clauses (SCCs) or an adequacy decision – to guarantee a level of protection equivalent to that within the EU, as outlined in Article 45.
10 / 10
A data subject has submitted a request for access to their personal data. Your team needs to fulfill this request. What is the most accurate description of your responsibility under GDPR's Article 12 (right to access)?
Article 12 explicitly states that you must provide a *copy* of all personal data held about an individual. This includes providing information in a usable format (like a spreadsheet or database extract), even if it's not perfectly formatted. The goal is to empower the data subject with full access and control over their information, supporting their right to rectification and erasure.
What will I practice in "GDPR Technical Implementation Vocabulary"?
This is a Privacy Engineering exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of privacy engineering terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the privacy engineering vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Privacy Engineering exercises?
See the Privacy Engineering exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — privacy engineering vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.