Compliance
GDPR
Not a privacy policy — a set of duties with named defaults
Lawful basis, who is the controller, what a right actually obliges you to do, and the two clocks that start when something goes wrong.
Start the map 6 pillars · 18 cards · about 27 minutes end to end
The map
Five minutes, once. Rate each pillar before you start and the cards you are shakiest on come first. Skipping it costs you nothing but the ordering.
-
Lawful basis
Six bases, none of them a default. Picking one is a decision you record, not a formality.
-
Controller and processor
Who decides the purposes carries the duties. The role follows the decisions, not the contract's title.
-
The rights of the data subject
Each right has a deadline, a scope, and exceptions that are narrower than people expect.
-
Personal data breaches
Two different thresholds, two different clocks, and a log that covers every breach either way.
-
International transfers
Leaving the EEA needs a named mechanism, and since Schrems II, a look at the destination.
-
Accountability
You must be able to demonstrate compliance — records, assessments, and sometimes an officer.
Apply it
One scenario per sitting, about ten minutes. No marking scheme that pretends to be objective — a rubric you are invited to argue with.
Read against Regulation (EU) 2016/679 (GDPR), Court of Justice of the EU, Case C-311/18 (Schrems II), 16 July 2020 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.