The controller's obligations
What the controller must be able to show: the register of processing, protection by design and by default, the processor contract, the impact assessment and the data protection officer.
- 22 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Record of processing activities: what is it?
Show the answer
A document kept by the controller that describes each processing operation: purpose, lawful basis, data categories, recipients, retention period, security measures.
The exemption for bodies under 250 people does not apply to regular processing: in practice nearly everyone keeps one. It is the first document shown in an inspection.
In which case is appointing a data protection officer mandatory?
- For a public body, whatever its size
- For any company with more than fifty employees
- As soon as a company processes customer data
- Only if the CNIL has demanded it in writing
Show the answer
For a public body, whatever its size
The duty depends on the nature of the processing or of the controller, not on an employee threshold or a prior order. A public body is subject to it, except a court acting in its judicial capacity.
An impact assessment is mandatory when a processing operation is likely to result in a … to rights and freedoms; the … publishes a list of the processing concerned.
Show the answer
An impact assessment is mandatory when a processing operation is likely to result in a high risk to rights and freedoms; the CNIL publishes a list of the processing concerned.
It is carried out before launch, not after an incident. If high risks remain despite the measures, the CNIL must be consulted.
Impact assessment (DPIA): what is it?
Show the answer
A study, mandatory before launching a processing operation likely to result in a high risk, describing the processing, its risks and the measures to reduce them.
The CNIL publishes a list of processing subject to it: large-scale monitoring of a public area, profiling, sensitive data on a large scale. Payroll for ten employees needs none.
A twelve-person start-up handles payroll and a customer file, and thinks that fewer than 250 employees exempt it from keeping a register. What is the position?
- It is exempt, because its headcount is below the threshold
- It keeps one only if it processes sensitive data
- It keeps one only if the CNIL asks for it
- It must keep a register: its processing is regular
Show the answer
It must keep a register: its processing is regular
The exemption is lost if the processing is not occasional, if it presents a risk or if it involves sensitive data. Payroll and a customer file are regular.