GDPR Performance Optimization 3 — Questions and Answers
Question 1: A GDPR-regulated SaaS platform stores user data in multiple EU regions for performance reasons. What must be documented to remain compliant?
- Only the primary storage location needs documentation
- All storage locations must be listed in the Records of Processing Activities (RoPA) (Correct answer)
- Multi-region storage is automatically compliant and requires no documentation
- Only cross-border transfers outside the EU need to be recorded
Correct answer: All storage locations must be listed in the Records of Processing Activities (RoPA)
Article 30 requires the RoPA to document all locations where personal data is stored or processed, including multiple EU regions used for performance.
Question 2: To optimize GDPR data retention workflows, an organization automates deletion of records past their retention period. Which safeguard is most critical for this automation?
- Require manual sign-off on every deletion to prevent errors
- Maintain an audit trail of automated deletions to demonstrate compliance
- Disable deletion automation for data subject to active legal holds
- Both B and C (Correct answer)
Correct answer: Both B and C
Automated deletion must be logged to satisfy accountability, and records under legal hold must be excluded to avoid destroying evidence or breaching other legal obligations.
Question 3: An organization wants to speed up GDPR impact assessments (DPIAs) by reusing previous assessments. When is reuse appropriate under GDPR?
- Reuse is always appropriate as long as the data category is the same
- Reuse is appropriate only when processing operations and risks are substantially similar (Correct answer)
- Reuse is never appropriate; each DPIA must be entirely new
- Reuse is appropriate only if approved by a supervisory authority
Correct answer: Reuse is appropriate only when processing operations and risks are substantially similar
Recital 92 allows similar processing operations to be covered by a single DPIA, making reuse valid when the nature, scope, context, and risks are substantially the same.
Question 4: Which database design choice most efficiently supports GDPR's storage limitation principle while optimizing query performance for active records?
- Store all records in one table with no expiry logic
- Separate active and archived records into hot/cold tiers with automated archival policies (Correct answer)
- Duplicate all records to a reporting database with no retention limits
- Keep all data in RAM to avoid disk-based retention issues
Correct answer: Separate active and archived records into hot/cold tiers with automated archival policies
Hot/cold tiering keeps frequently accessed active records fast to query while automated archival enforces storage limitation by moving or deleting data past its retention period.
Question 5: A consent management platform (CMP) must record granular consent with timestamps at high throughput. Which storage approach best handles write-heavy consent logging under GDPR?
- Use a relational database with full ACID transactions for every consent event
- Use an append-only event log (e.g., Kafka-backed) with periodic compaction to a consent store (Correct answer)
- Store consent in browser cookies only to reduce server load
- Aggregate consent events hourly to reduce write volume
Correct answer: Use an append-only event log (e.g., Kafka-backed) with periodic compaction to a consent store
An append-only event log absorbs high write throughput efficiently and provides an immutable audit trail, while compaction builds the current consent state for reads.
Question 6: Under GDPR, what is the performance implication of implementing encryption at rest for personal data, and how should it be addressed?
- Encryption at rest has no performance impact and requires no optimization
- I/O latency increases; use hardware-accelerated encryption (AES-NI) to minimize overhead (Correct answer)
- Encryption at rest must be disabled for production databases due to performance costs
- Only encrypt data during transfer, not at rest, to maintain performance
Correct answer: I/O latency increases; use hardware-accelerated encryption (AES-NI) to minimize overhead
Hardware-accelerated AES-NI virtually eliminates the CPU overhead of AES encryption, making at-rest encryption practical without significant performance degradation.
Question 7: A data controller wants to optimize cross-service personal data lookups via a shared identity graph. What GDPR principle must be evaluated before building this system?
- Data portability, since users may want to export the graph
- Purpose limitation, since combining data from multiple services may exceed original processing purposes (Correct answer)
- Accuracy, since graph data may become stale quickly
- Transparency, since the graph must be publicly documented
Correct answer: Purpose limitation, since combining data from multiple services may exceed original processing purposes
Article 5(1)(b) requires that personal data not be processed in a manner incompatible with the original purposes for which it was collected, so cross-service linkage must be evaluated against each service's stated purpose.
GDPR Performance Optimization 3
A GDPR-regulated SaaS platform stores user data in multiple EU regions for performance reasons.
What must be documented to remain compliant?