TodayTools

GDPR flashcards

The EU's data protection law, and what it means for apps worldwide.

Donate
Beginner friendly, starts from zero
Section
How to study
0
GDPRStart from zero · 1 of 12

What is GDPR, in one plain sentence?

GDPR is a European law that says how companies may collect and use information about people, and gives people rights over that information.

Your information, your say.
Show again
12 left
Got it

Tap to turn over. Swipe right if you know it, left to see it again.

All topics

What you will learn

  1. Start from zero

    • What GDPR is and why it exists4 cards
    • Key words: personal data, controller, lawful basis5 cards
    • Regulators and getting started3 cards

  2. Core basics

    • Who and what GDPR covers3 cards
    • The seven principles and accountability3 cards
    • Lawful bases and consent5 cards
    • Special data, privacy notices and regulators3 cards

  3. Next steps

    • Rights of individuals7 cards
    • Accountability tools: records, DPO, DPIA, interests test5 cards
    • Processors and joint controllers3 cards
    • Security and breach notification4 cards

  4. Go deeper

    • International transfers4 cards
    • Fines, enforcement and remedies5 cards
    • EU representatives and privacy by design2 cards
    • Anonymisation and cookies2 cards
    • Changes ahead and the UK2 cards
    • AI training and staff monitoring2 cards

Final test and certificate

10 questions drawn fresh from the whole topic, about 15 minutes. Sign in, score 80% or more and get a free certificate with your name and a public check link anyone can open, such as an employer or a teacher. Not signed in? Try a practice test from the cards.

Take the final test

About these cards

  • Reviewed 26 October 2026
  • CoversRegulation (EU) 2016/679 (GDPR) as in force October 2026Standard Contractual Clauses, Decision (EU) 2021/914EU-US Data Privacy Framework adequacy decision of 10 July 2023UK GDPR as amended by the Data (Use and Access) Act 2025
How these cards are made

GDPR at a glance

GDPR is the European law that decides how companies may collect and use information about people.

Like lending a neighbour your house key: he uses it only for what you agreed, keeps it safe and gives it back.

Words you will meet

Personal data
Any information that can point to a living person
Processing
Anything done with data: collect, store, view, share or delete
Controller
The company that decides why and how data is used
Processor
A company that handles data on the controller's orders
Lawful basis
The valid reason you need for each use of data
Consent
A clear, free yes that can be taken back any time
Privacy notice
The page that tells people what you collect and why
Supervisory authority
The national regulator that enforces GDPR

The steps

  1. 1. Start from zero (12 cards): What GDPR is, who it protects and the key words, in plain language.
  2. 2. Core basics (14 cards): Scope, roles, principles and the six lawful bases.
  3. 3. Next steps (19 cards): Rights, records, DPOs, DPIAs, processors and breaches.
  4. 4. Go deeper (17 cards): Transfers, fines, enforcement, design duties and current changes.
All 12 cards in Start from zero
What is GDPR, in one plain sentence?
GDPR is a European law that says how companies may collect and use information about people, and gives people rights over that information.
What was life like before GDPR?
Companies often gathered, shared and kept data quietly, rules differed by country, and people had no easy way to see or delete it. Since 25 May 2018 one law covers the whole EU.
Where do you already meet GDPR in daily life?
Cookie banners asking your choice, a 'download my data' button, one-click unsubscribe links and sign-up boxes for emails that start unticked.
What everyday situation is GDPR like?
Lending a neighbour your house key. He may use it only for what you agreed, like watering plants, must keep it safe, give it back when done, and tell you at once if it is lost.
What are the EU, the EEA, a member state, a 'regulation' and an 'Article'?
The EU is a group of 27 European countries, each one a member state; the EEA adds Iceland, Liechtenstein and Norway. A regulation is a law that applies directly in all of them, and an Article is one numbered section of it.
What counts as 'personal data', and what is 'processing'?
Personal data is anything that can point to a living person: name, phone, photo, an IP address (your device's number online) or a cookie ID (a label a website saves in your browser). Processing is anything done with it: collect, store, view, share or delete.
Who is a 'controller' and who is a 'processor'?
The controller decides why and how data is used, like a shop running its own app. A processor does the work on its behalf, like a cloud company such as AWS storing the shop's files.
What are a 'lawful basis' and 'consent'?
A lawful basis is the valid reason you need for each use of data; GDPR lists six. Consent is one of them: a clear, free yes, which the person can take back any time.
What are a privacy notice, retention, a transfer and a DPO?
A privacy notice is the page that tells people what you collect and why. Retention is how long you keep data, a transfer is sending it to another country, and a DPO (data protection officer) is the person who watches over all this.
Who checks that companies follow GDPR?
Each country has a supervisory authority, a data protection regulator, joined in the EDPB (European Data Protection Board). Fines can reach 20 million euros or 4% of yearly worldwide turnover, whichever is higher.
What do you need before starting?
Nothing: no law degree and no code. It helps to have a list of the data your app or business collects, so you can test each card against it.
What will you be able to do after this topic?
Tell whether GDPR applies to you, pick the right lawful basis for each use, write an honest privacy notice, and handle consent and people's requests properly.
GDPR cheatsheet

Key articles

  • Art 3 Territorial scope
  • Art 5 / 6 Principles / lawful bases
  • Art 7 / 8 Consent / children
  • Art 9 Special category data
  • Art 12 to 22 Rights and how to answer
  • Art 25 Privacy by design and default
  • Art 28 / 30 Processor contract / records
  • Art 33 / 34 Breach to authority / to people
  • Art 35 / 37 DPIA / DPO
  • Art 44 to 49 / 83 Transfers / fines

Lawful bases (Art 6(1))

  • (a) Consent Clear opt in, easy to withdraw
  • (b) Contract Needed for what they asked
  • (c) Legal obligation A law requires it
  • (d) Vital interests Protect a life
  • (e) Public task Official function
  • (f) Legitimate interests Balanced need, record the test

Deadlines

  • 72 hours Breach to supervisory authority
  • Without undue delay High risk breach to people
  • Without undue delay Processor to controller
  • 1 month Answer rights requests
  • Plus 2 months Extension, tell within month 1
  • Before start DPIA for high risk

Transfers

  • Adequacy Commission approved countries
  • SCCs 2021 4 modules by role
  • TIA Check destination law
  • BCRs Approved group rules
  • DPF Certified US firms, since 10 Jul 2023
  • Art 49 Narrow exceptions

Fines and cases

  • Tier 1 10M euros or 2%
  • Tier 2 20M euros or 4%
  • Rule Whichever is higher
  • Meta 2023 1.2B euros, transfers
  • Planet49 2019 Pre-ticked boxes invalid
  • Schrems II 2020 Privacy Shield struck down
Donate