What is a well-defined concept of GDPR compliance?

The General Data Protection Regulation (GDPR) establishes several core rights for individuals, known as data subjects. A well-defined and central concept of GDPR is the "right to erasure," also known as the "right to be forgotten," as codified in Article 17. This right empowers data subjects to request the deletion of their personal data from a data controller's systems under certain conditions, such as when the data is no longer necessary for the purpose it was collected or when the data subject withdraws consent. This principle is fundamental to giving individuals control over their personal information.

B. This describes a lawful basis for data retention (contractual necessity), which is a specific condition under GDPR, not a broad, defining concept of compliance itself.

C. This is incorrect. GDPR applies to all personal data an organization holds, regardless of when it was collected, once the regulation became enforceable on May 25, 2018.

D. This is incorrect. GDPR has an extra-territorial scope; it applies to any organization processing the personal data of EU residents, regardless of the organization's physical location.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation)

Official Journal of the European Union

L 119/1.

Article 17

"Right to erasure (‘right to be forgotten’)": "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay..." This directly supports option A as a core concept.

Article 3

"Territorial scope

" Paragraph 2: States that the regulation applies to controllers or processors not established in the Union where the processing activities are related to offering goods or services to data subjects in the Union. This refutes option D.

Article 6

"Lawfulness of processing

" Paragraph 1(b): Identifies that processing is lawful if it is "necessary for the performance of a contract." This provides context for option B as a condition

not a core concept.

2. European Commission

"Data protection rules as a trust-enabler in the EU and beyond"

COM(2018) 43 final.

Section 2.1

"Application of the GDPR to data processed before May 2018": "The GDPR applies to any processing of personal data which takes place after its date of application

25 May 2018

even if that processing started before that date." This refutes option C.

3. Stanford University

"GDPR Privacy Statement"

Stanford University Privacy Office.

Section "Your GDPR Rights": Lists the "Right to Erasure" as one of the key rights afforded to individuals under the GDPR

reinforcing it as a central concept of the regulation.