GDPR Architecture & System Design 4

Question 1

A company uses a multi-tenant SaaS architecture. Under GDPR, what is the MOST important architectural control to prevent one tenant's personal data from being accessible to another?

Accepted Answer

Strict tenant isolation through separate encryption keys, row-level security, or schema separation

Answer

Strong tenant isolation prevents unauthorized cross-tenant data access, which could constitute a personal data breach under GDPR Article 33.

Question 2

Which pseudonymization technique replaces a direct identifier with a reversible token stored in a separate, access-controlled mapping table?

Accepted Answer

Tokenization

Answer

Tokenization substitutes identifiers with surrogate tokens while maintaining a secure mapping table, allowing re-identification only by authorized parties with access to the vault.

Question 3

When conducting a Data Protection Impact Assessment (DPIA) for a new AI recommendation system, which architectural element requires the MOST scrutiny?

Accepted Answer

Automated decision-making logic that produces legal or similarly significant effects

Answer

GDPR Article 22 places strict obligations on automated decision-making with significant effects, making the recommendation logic the highest-risk element requiring DPIA scrutiny.

Question 4

In event-driven architectures, how should personal data included in events be handled to support GDPR compliance?

Accepted Answer

Use event references with IDs and let consumers fetch personal data from authoritative sources under access control

Answer

Referencing data by ID rather than embedding it limits personal data propagation across the event bus and ensures access-controlled retrieval from the authoritative source.

Question 5

A GDPR-compliant data retention architecture must enforce automatic deletion of personal data. Which pattern BEST achieves this at scale?

Accepted Answer

Automated retention policy enforcement via scheduled jobs tied to per-record retention metadata

Answer

Per-record retention metadata combined with automated scheduled enforcement allows fine-grained, auditable deletion aligned with each record's specific lawful basis and retention period.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Architecture & System Design 4