Lion Cipher Lab
Does the GDPR apply to you? Establish a lawful basis, build a Record of Processing (ROPA), and map data-subject rights
- GRC / Compliance
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Almost every organisation that touches a customer, an employee or a website visitor processes personal data, and the GDPR is the law that decides what it may do with it. It is not a European curiosity you can ignore from elsewhere: its territorial scope reaches any organisation, anywhere, that offers goods or services to people in the EU or monitors their behaviour, so a US or Asian startup with a checkout that ships to Berlin is squarely inside it. And the price of getting it wrong is set deliberately high - up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.…
What you'll learn
- GDPR applicability: material scope (personal data, processing) and territorial scope under Article 3
- the controller vs processor distinction, and why it changes who owes what
- choosing and JUSTIFYING a lawful basis under Article 6 - and knowing when consent is the wrong answer
- handling special-category data under Article 9
- building a real Record of Processing Activities (ROPA) under Article 30, and when the <250 exemption does NOT apply
- mapping the data-subject rights (Articles 15-22) and running the one-month response clock
- the two breach clocks: Article 33 (supervisory authority, 72 hours where feasible) and Article 34 (data subjects, high risk)
- distinguishing EU GDPR from the UK GDPR and the role of a supervisory authority
Steps in this lab
- What the GDPR is - and why REGULATION and 25 May 2018 are the two facts to fix first
- This lab vs the DPIA lab - scope the programme, not one risky activity
- Set up your worksheet and pick a fictional org
- Scope part 1 - MATERIAL scope: is this even personal data being processed?
- Scope part 2 - TERRITORIAL scope (Article 3): why a non-EU org is still caught
- Controller or processor? - the role that decides who owes what
- Lawful basis (Article 6) - pick ONE per activity, and know why consent is usually the wrong reflex
- Special-category data (Article 9) - the higher bar, and why it needs its own gate
- Build the Record of Processing Activities (ROPA) - the backbone deliverable
- Data-subject rights (Articles 12-22) and the one-month clock - write the runbook
- Breach notification - two clocks: Article 33 (authority, 72h where feasible) and Article 34 (people, high risk)
- Do it better - the pitfalls that quietly invalidate a 'compliant' programme
- Write the one-page verdict and the deliverables checklist