Library for the GDPR exam
Guides, the official German titles of the GDPR, the BDSG and the TDDDG, and the court rulings whose sentence we can point at in a guide. Statute titles are not translated. Chapter titles stay in German, because that is how they are stored.
DSGVO Grundlagen & Prinzipien
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
RulingEuGH, C-413/23 P
4 September 2025 judgment in Case C-413/23 P, EDPS v SRB (paragraph 111).
GuideGDPR Data protection by design and by default (Article 25)
Understand the practical differences between data protection by design and by default under GDPR Article 25.
GuideGDPR Principles (Article 5): The 7 Rules Explained
Article 5 GDPR: six processing principles in paragraph 1 and accountability in paragraph 2, in the words of Regulation (EU) 2016/679.
GuideThe EU GDPR Explained: A Complete Guide
A plain-English walkthrough of Regulation (EU) 2016/679 — scope, the seven principles, six lawful bases, data subject rights, controller and processor duties, the DPO role, breaches, transfers and fines. Every claim t…
GuideGDPR Anonymisation vs Pseudonymisation: The 2026 EDPB Test
An exam-focused guide to GDPR anonymisation vs pseudonymisation, the EDPB Guidelines 02/2026 three-criterion test, hashes and recipient perspective.
Rechtsgrundlagen der Datenverarbeitung (Art. 6, 9 DSGVO)
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
GuideGDPR Consent Requirements (Article 7)
Article 7 conditions for consent, the Article 4(11) definition, Recitals 32, 42 and 43, and Article 8 for information society services offered directly to a child.
GuideLegitimate Interest Under GDPR: The Three-Part Test Explained
A deep dive into Article 6(1)(f) — the three cumulative conditions, the EDPB’s 2024 balancing-test factors, direct marketing rules, the right to object and children’s data, grounded in EDPB Guidelines 1/2024.
GuideGDPR Article 9 Special Category Data: The Lindenapotheke Test
GDPR Article 9 special category data explained: the prohibition, the ten Article 9(2) exceptions, Recital 51 on photographs, and CJEU C-21/23 Lindenapotheke on pharmacy-only order data as health data.
Betroffenenrechte (Art. 12–22 DSGVO)
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
RulingEuGH, C-526/24
The CJEU confirmed in Case C-526/24 that a breach of the right of access can itself trigger an Article 82 damages claim, independent of any unlawful processing.
GuideGDPR Right to Object: Article 21 Marketing Stop vs Qualified Objection
When the GDPR right to object is absolute for direct marketing under Article 21(2), when Article 21(1) is only qualified, and how objection, restriction and erasure fit together — cited to the Regulation and EDPB Guid…
GuideGDPR Article 13 vs Article 14: Information Obligations Explained
A side-by-side comparison of Articles 13 and 14 -- scope, staggered timing, the categories-of-data and source-of-data disclosures unique to Article 14, and why Article 14 has four exemptions where Article 13 has only…
GuideHow to Handle a GDPR Subject Access Request: Deadlines and Refusal Grounds
Article 15 access requests explained: the one-month deadline, what must be disclosed, when a fee applies, the Article 12(5) refusal grounds, and the March 2026 CJEU ruling on abusive first-time requests (Case C-526/24…
GuideGDPR Article 17: Right to Erasure Explained
Article 17 explained: the six erasure grounds, the five Article 17(3) exceptions, and the Article 17(2) vs Article 19 distinction that trips up most exam candidates.
GuideGDPR Data Portability: Article 20 Explained
A practical comparison of Article 20 portability and Article 15 access: qualifying legal bases, automated processing, machine-readable formats, direct controller-to-controller transfer and the limits that matter in ex…
GuideGDPR Article 22: Automated Decision-Making and Profiling
Article 22 GDPR explained: the three-part test for automated decisions, the SCHUFA scoring ruling, and the 2025 Dun & Bradstreet right to an explanation.
Pflichten des Verantwortlichen & Auftragsverarbeitung
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
RulingEuGH, C-311/18
The CJEU annulled the original Safe Harbor framework in Schrems I (2015) and its successor Privacy Shield in Schrems II (2020), both times over concerns about US government surveillance access and the lack of an effec…
GuideWhen is a Data Protection Officer (DPO) required under GDPR?
Learn exactly when appointing a Data Protection Officer (DPO) is mandatory under Article 37 of the GDPR, what their tasks are, and who is allowed to take on the role without a conflict of interest.
GuideInternational Data Transfers Under GDPR: Adequacy, SCCs and the EU-US Data Privacy Framework
The three Chapter V transfer mechanisms explained — adequacy decisions, Standard Contractual Clauses with a Transfer Impact Assessment, and Article 49 derogations — plus what the General Court’s September 2025 Latombe…
GuideRecord of Processing Activities (RoPA) GDPR Article 30 Requirements
Learn what a Record of Processing Activities (RoPA) is, what it must include, and why the Article 30(5) exemption for under 250 employees rarely applies.
GuideJoint Controllers Under GDPR Article 26: The Facebook Fan Page Ruling
What Article 26 requires of joint controllers, and how the CJEU’s Facebook fan page ruling (Case C-210/16) established that platform users configuring third-party analytics can be joint controllers -- with a worked ex…
GuideGDPR Processor Agreement: What Article 28 Requires
A primary-source guide to GDPR processor agreements under Article 28: who is a processor, the mandatory contract clauses, sub-processors, Commission SCCs and when a processor becomes a controller.
Technisch-organisatorische Maßnahmen (TOMs)
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
RulingEuGH, C-340/21
The CJEU ruled in Case C-340/21 (Natsionalna agentsia za prihodite) that the occurrence of a data breach by third-party hackers does not automatically mean the controller’s security measures were inadequate under Arti…
Datenschutz-Folgenabschätzung (DSFA, Art. 35 DSGVO)
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
GuideWhen is a Data Protection Impact Assessment (DPIA) required under the GDPR?
Learn when a Data Protection Impact Assessment (DPIA) is mandatory under Article 35 of the GDPR, what triggers a high risk, and who is responsible for conducting it.
Meldepflichten & Datenpannen (Art. 33–34 DSGVO)
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
GuideGDPR Data Breach Notification: Articles 33 & 34 Explained
A complete practitioner guide to GDPR data breach notification requirements under Articles 33 & 34: the 72-hour rule, risk vs. high-risk thresholds, processor duties, DPA reporting contents, CJEU C-340/21, and EDPB Gu…
BDSG & nationale Regelungen
StatuteBDSG
Bundesdatenschutzgesetz
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
Spezielle Verarbeitungssituationen (HR, Marketing, CCTV)
StatuteBDSG
Bundesdatenschutzgesetz
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
StatuteTDDDG
Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten
Aufsichtsbehörden, Sanktionen & Bußgelder
StatuteBDSG
Bundesdatenschutzgesetz
StatuteDSGVO
Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtli…
RulingEuGH, C-300/21
No formal threshold exists. The CJEU has twice rejected a "de minimis" requirement for non-material damage — first in Case C-300/21 (Österreichische Post, 4 May 2023) and again in Case C-655/23 (2025), which held that…
GuideGDPR Compensation Claims: When Does Non-Material Damage Qualify?
A practical guide to Article 82 compensation claims, built on the 2025 CJEU ruling in IP v Quirin Privatbank (C-655/23) and 2023’s Österreichische Post case: no seriousness threshold, fault-irrelevant amounts, control…
GuideHow Are GDPR Fines Calculated? Article 83 & EDPB Guidelines 04/2022
A structured guide to GDPR fine calculation, covering Article 83 statutory maximums and the EDPB 5-step methodology used by supervisory authorities.
Other
GuideGDPR Exam Practice Questions
18 free multiple-choice GDPR exam practice questions across principles, data subject rights, RoPA, breach notification, DPIAs, DPO rules and fines — every answer cited to its exact article.
GuideHow Much Does DPO / GDPR Certification Cost?
A cost comparison of IAPP (CIPP/E, CIPM), BCS, PECB CDPO and Germany’s TÜV/DEKRA DSB certification paths, with verified official pricing and clearly flagged approximate figures.
Stand: 10/2026 · Statutes link to the official source. Not legal advice.
The same chapters as practice questions
The library sorts the sources. The trainer asks about them.
Register free