Objectives in this domain

Know the historical rationale for data protection and understand relevant human rights laws and early data protection instruments such as the OECD Guidelines, the Treaty of Lisbon, and Convention 108.
Section 1.1easy
Understand how the need for a harmonised European approach to data protection developed and know the challenges involved in implementing it, including the implications of Brexit.
Section 1.2medium
Know the roles and functions of key European Union institutions including the Council of Europe, the European Court of Human Rights, the European Parliament, the European Commission, the European Council, and the Court of Justice of the European Union.
Section 1.3easy
Understand the main principles and goals of significant data protection legislation including the GDPR, the NIS/NIS 2 Directives, the ePrivacy Directive, and the EU Artificial Intelligence Act.
Section 1.4medium

Sample question from this domain

Free sampleIntroduction to European Data Protectionmedium

A Berlin-based SaaS company processes employee and customer personal data and is mapping which EU instruments govern its activities. Its compliance lead notes that one instrument sets out the general, cross-sector rules for processing personal data, while the others address narrower fields such as electronic communications confidentiality and the cybersecurity of essential services. Which instrument provides the general legal framework for the processing of personal data across all sectors in the EU?

AThe ePrivacy Directive 2002/58/EC, which sets the baseline rules for processing personal data across sectors
BThe NIS 2 Directive, which sets the baseline rules for processing personal data across sectors
CThe EU Artificial Intelligence Act, which sets the baseline rules for processing personal data across sectors
DRegulation (EU) 2016/679, the General Data Protection Regulation, which sets the baseline rules for processing personal data across sectors Correct

Identify the GDPR as the general cross-sector framework for processing personal data, distinct from sector-specific EU instruments. The GDPR is a directly applicable regulation that establishes the general rules for processing personal data in every sector, while ePrivacy, NIS 2, and the AI Act each address a narrower subject area and supplement the GDPR rather than displace it.

Why A is wrong: The ePrivacy Directive is tempting because it does protect personal data, but it is sector-specific to electronic communications and confidentiality of communications, not the general framework.

Why B is wrong: NIS 2 is tempting because it imposes broad obligations on many entities, but it governs cybersecurity risk management and incident reporting, not the general rules for processing personal data.

Why C is wrong: The AI Act is tempting because it is a recent EU-wide regulation, but it regulates the placing on the market and use of AI systems by risk tier, not personal data processing generally.

Why D is correct: The GDPR is the general, directly applicable instrument governing the processing of personal data across all sectors in the EU, and the other instruments supplement rather than replace it.

Other domains in this exam

European Data Protection Law and Regulation31% of the exam
European Data Processing23% of the exam
European Data Protection: Scope and Accountability17% of the exam
Compliance with European Data Protection Law and Regulation16% of the exam

See also the CIPP-E cert hub, the study guide, and the cheat sheet.