Seven Principles at Work — TechKnowSurge

About this interactive

GDPR, the European Union's General Data Protection Regulation, has applied since May 2018. It sets seven principles for anyone handling the personal data of people in the EU. Lawfulness, fairness and transparency: there must be a legal basis for the processing, it must be honest, and people must be told plainly what is collected and who has it. The lesson describes this as getting consent first. Consent is one of GDPR's six legal bases; a contract, a legal duty or a legitimate interest can be others. Where consent is the basis, it has to be a clear yes, so a pre-ticked box does not count. Purpose limitation: data collected for one stated purpose is not later used for an unrelated one. Data minimization: collect no more than the purpose needs. This is about how much is collected. Accuracy: keep the data correct and up to date, and fix it when it is wrong. Storage limitation: keep data only as long as it is needed, or as long as a law requires. This is about how long it is kept. Integrity and confidentiality: protect the data from loss, damage and anyone who should not see it, inside or outside the company. Accountability: the company has to be able to prove it follows the principles, with records, documents and checks. Penalties reach 4% of a company's worldwide annual turnover or 20 million euros, whichever is higher. The video says 2 million; the figure is 20 million.

What you'll learn

Name the GDPR principle a company's handling of personal data follows or breaks: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; or accountability
Tell the near pairs apart: how much data is collected (data minimization) from how long it is kept (storage limitation), and keeping data correct (accuracy) from keeping it safe (integrity and confidentiality)

Aligned to

CompTIA Security+

5.4 Summarize elements of effective security compliance.

ISC2 CISSP

1.4 Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

NIST NICE

K0681 Knowledge of privacy principles and practices

Key terms

General Data Protection Regulation: A European Union regulation that establishes comprehensive data protection and privacy rights for individuals within the EU and EEA, and imposes obligations on organizations that process EU residents' personal data regardless of where the organization is located. GDPR introduced concepts such as data minimization, the right to erasure, and mandatory breach notification.
Lawfulness, Fairness, and Transparency: A GDPR principle requiring that data collection and processing be legally justified, conducted honestly, and clearly communicated to the data subject.
Purpose Limitation: A GDPR principle that restricts the use of collected data strictly to the purpose originally stated at the time of collection.
Storage Limitation: A GDPR principle requiring that personal data be retained only for as long as necessary to fulfill its stated processing purpose.
Data Subject: An individual whose personal data is being collected and processed by another party.

Topics

Gdpr Privacy Data Protection Principles Regulatory Compliance Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →