GDPR Automation & Scripting 3 — Questions and Answers
Question 1: An ETL pipeline automatically enriches customer records by joining internal data with purchased third-party datasets. What GDPR obligation is most likely triggered?
- A new Data Processing Agreement with every customer
- Conducting a Data Protection Impact Assessment due to systematic combination of data (Correct answer)
- Immediate notification to the supervisory authority
- Automatic pseudonymisation of all output records
Correct answer: Conducting a Data Protection Impact Assessment due to systematic combination of data
Article 35 and Recital 91 require a DPIA when systematic and extensive profiling or combination of personal data occurs at scale.
Question 2: Which privacy-by-design principle should guide the default configuration of a newly deployed automated data collection script?
- Collect all available data fields to maximise future utility
- Default to collecting only the minimum data necessary for the stated purpose (Correct answer)
- Encrypt all data only after the retention period expires
- Obtain consent only if the data is sensitive
Correct answer: Default to collecting only the minimum data necessary for the stated purpose
Article 25 requires data protection by design and by default, meaning systems must default to the most privacy-friendly settings.
Question 3: A healthcare provider's automated appointment reminder system processes patient data. Which legal basis is most appropriate under GDPR?
- Legitimate interests of the controller
- Performance of a contract or compliance with a legal obligation (Correct answer)
- Explicit consent obtained at each appointment
- Public interest under Article 9(2)(g)
Correct answer: Performance of a contract or compliance with a legal obligation
Sending appointment reminders directly relates to the performance of the healthcare contract or fulfils a legal duty of care, making Article 6(1)(b) or (c) most appropriate.
Question 4: In automated processing, what does 'pseudonymisation' achieve under GDPR compared to full anonymisation?
- It removes all re-identification risk, making GDPR inapplicable
- It reduces risk but the data remains personal data subject to GDPR (Correct answer)
- It is only valid if approved by a supervisory authority
- It eliminates the need for a Data Processing Agreement
Correct answer: It reduces risk but the data remains personal data subject to GDPR
Recital 26 clarifies that pseudonymised data can be re-identified using additional information and therefore remains personal data subject to GDPR protections.
Question 5: A company's CI/CD pipeline automatically deploys code changes to a system that processes personal data. What GDPR consideration must be embedded in this pipeline?
- Supervisory authority must approve each deployment
- Security and privacy impact reviews must gate production deployments (Correct answer)
- All deployments must pause for 72 hours for DPA notification
- Automated deployments are prohibited under GDPR Article 32
Correct answer: Security and privacy impact reviews must gate production deployments
Article 25 (privacy by design) and Article 32 (security of processing) require that privacy and security controls be integrated into development and deployment processes.
Question 6: When a script detects a potential personal data breach, what is the maximum timeframe within which the supervisory authority must be notified?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
Article 33(1) requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.
Question 7: An automated script transfers EU personal data to a US-based processor after the invalidation of Privacy Shield. Which mechanism now provides the best compliance path?
- Binding Corporate Rules only
- Standard Contractual Clauses (SCCs) adopted in 2021, supplemented by a Transfer Impact Assessment (Correct answer)
- Explicit consent from every individual data subject
- A temporary derogation under Article 49(1)(a)
Correct answer: Standard Contractual Clauses (SCCs) adopted in 2021, supplemented by a Transfer Impact Assessment
Following Schrems II, the 2021 SCCs remain valid for EU-US transfers, but controllers must also conduct a Transfer Impact Assessment to verify equivalent protection.
GDPR Automation & Scripting 3
An ETL pipeline automatically enriches customer records by joining internal data with purchased third-party datasets.
What GDPR obligation is most likely triggered?