GDPR Performance Optimization 2 — Questions and Answers
Question 1: An organization processes 10 million records for GDPR compliance audits nightly. Which database strategy best reduces processing time while maintaining data minimization principles?
- Index all columns for maximum query speed
- Partition tables by processing date and index only audit-relevant columns (Correct answer)
- Store all data in a single denormalized table for faster reads
- Replicate the entire dataset to an in-memory database
Correct answer: Partition tables by processing date and index only audit-relevant columns
Date partitioning limits scan scope to relevant records, and selective indexing balances query speed with storage overhead while avoiding unnecessary data retention.
Question 2: Under GDPR, a controller must respond to a Data Subject Access Request (DSAR) within one month. Which approach optimizes response time without violating data minimization?
- Pre-generate full data exports nightly for every data subject
- Build a subject-indexed view that aggregates only personal data fields on demand (Correct answer)
- Cache all personal data in a fast-access layer indefinitely
- Outsource DSAR fulfillment to a third-party processor with no SLA
Correct answer: Build a subject-indexed view that aggregates only personal data fields on demand
An on-demand indexed view retrieves only the specific subject's personal data fields, meeting the one-month deadline without retaining unnecessary pre-generated exports.
Question 3: A DPO notices that pseudonymization is slowing record linkage by 40%. What is the GDPR-compliant way to optimize this performance bottleneck?
- Remove pseudonymization to improve speed
- Use deterministic tokenization with a secure key to enable consistent lookups (Correct answer)
- Store both raw and pseudonymized values side by side
- Skip pseudonymization for internal analytics systems
Correct answer: Use deterministic tokenization with a secure key to enable consistent lookups
Deterministic tokenization produces the same token for the same input, enabling fast joins while keeping pseudonymization intact and GDPR-compliant.
Question 4: Which caching strategy for a GDPR-regulated user profile service most effectively balances performance with the right to erasure?
- Cache profiles indefinitely with no invalidation logic
- Use short TTL caches with event-driven invalidation triggered by erasure requests (Correct answer)
- Cache only aggregate statistics and never individual profiles
- Disable caching entirely to ensure immediate erasure compliance
Correct answer: Use short TTL caches with event-driven invalidation triggered by erasure requests
Short TTL plus event-driven invalidation ensures cached personal data is removed promptly when an erasure request is processed, balancing speed with Article 17 compliance.
Question 5: An e-commerce platform runs real-time consent checks on every page load, causing 300ms latency. What optimization maintains valid consent verification under GDPR?
- Remove consent checks from the request path entirely
- Cache consent status per user with invalidation on consent withdrawal (Correct answer)
- Batch consent checks and apply them asynchronously after serving the page
- Use a global default 'consented' flag to bypass per-user checks
Correct answer: Cache consent status per user with invalidation on consent withdrawal
Caching consent status with immediate invalidation on withdrawal reduces latency while ensuring that withdrawn consent is respected before any further processing.
Question 6: A data pipeline anonymizes personal data before analytics processing. To optimize throughput, engineers propose deferring anonymization to after initial processing. What is the GDPR risk?
- No risk; anonymization timing does not affect GDPR obligations
- Personal data would be processed without a lawful basis during the deferred window (Correct answer)
- It only creates a risk if the data crosses EU borders
- The risk is limited to storage costs, not regulatory compliance
Correct answer: Personal data would be processed without a lawful basis during the deferred window
Processing identifiable personal data before anonymization requires a lawful basis; deferring anonymization means personal data is processed without that basis during the pipeline stage.
Question 7: An organization uses microservices architecture and wants to optimize GDPR audit logging performance. Which pattern best reduces logging overhead while meeting accountability requirements?
- Log every field of every request synchronously in each microservice
- Emit structured audit events asynchronously to a centralized immutable log store (Correct answer)
- Store audit logs only in application memory to avoid I/O latency
- Disable audit logging in non-production environments to reduce overall load
Correct answer: Emit structured audit events asynchronously to a centralized immutable log store
Asynchronous structured event emission decouples logging latency from request handling while a centralized immutable store satisfies GDPR accountability under Article 5(2).
GDPR Performance Optimization 2
An organization processes 10 million records for GDPR compliance audits nightly.
Which database strategy best reduces processing time while maintaining data minimization principles?