Data Management & Integration Flashcards

A company discovers that a data integration script has been sending customer email addresses to an incorrect third-party server for 48 hours. Under GDPR, within what timeframe must it notify the supervisory authority?

Answer: Without undue delay and, where feasible, within 72 hours of becoming aware

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach.

When implementing data integration across multiple countries within the EU, which concept allows a multinational company to deal with a single supervisory authority for cross-border processing?

Answer: The one-stop-shop mechanism under Article 56

Article 56 establishes the one-stop-shop mechanism, letting controllers with cross-border operations engage primarily with the supervisory authority of their EU main establishment.

A data engineering team proposes storing a hash of each customer's email address as a unique key in an integrated dataset. Under GDPR, this hashed value is most accurately classified as:

Answer: Personal data if the hash can be reversed or if the original email is also held

A hash is pseudonymous personal data if the original email is still held elsewhere, because re-identification is possible using the retained plaintext and the same hash function.

An organisation is building a real-time data integration pipeline and wants to apply privacy by design. Which action best embodies this GDPR principle at the architecture stage?

Answer: Embedding data minimisation and access controls into the pipeline before it goes live

Article 25 requires controllers to implement data protection by design and by default, meaning privacy controls must be built in from the outset, not retrofitted.

A controller receives a data subject access request (DSAR) from a customer whose data is spread across eight integrated systems. The controller has one month to respond. What is the maximum extension period allowed under GDPR?

Answer: Two additional months if the request is complex or numerous

Article 12(3) allows the response deadline to be extended by two further months where requests are complex or numerous, provided the data subject is informed within the original one-month period.

A cloud data platform provider processes personal data exclusively on documented instructions from its customer (the controller). If the provider independently decides to use that data for its own analytics, it becomes:

Answer: A controller in respect of that unauthorised processing

Under Article 28(10), a processor that determines the purposes and means of processing beyond the controller's instructions becomes a controller and bears full GDPR liability for that processing.

Which of the following data integration techniques provides the strongest privacy protection when sharing data with a research partner under GDPR?

Answer: Federated learning, where only model updates — not raw data — are exchanged

Federated learning allows model training without transferring raw personal data, thereby minimising data exposure and reducing GDPR risk compared to any direct data transfer.