Global Data Protection Regulations (GDPR, CCPA, LGPD)

Answer Strategy

Structure answer around the Lawful Basis (likely Legitimate Interest with a balancing test), the requirement for a robust DPA with SCCs (specifically Module 2: Controller to Processor), and the mandate for a Transfer Impact Assessment (TIA) evaluating the vendor's local laws. Mention specific technical measures like encryption in transit/at rest, contractual audit rights, and the vendor's ability to support data subject rights. Sample Answer: 'First, I'd confirm our lawful basis, likely Legitimate Interest, via a documented LIA. The foundation is a DPA incorporating the new EU SCCs, specifically Module 2. I would then conduct a TIA to assess if the vendor's legal environment undermines the SCCs' protections, requiring supplementary measures like strict access controls and a commitment to challenge overbroad government requests. Contractually, I'd require clear audit rights, a data breach notification timeline of 24-48 hours, and technical support for our DSAR obligations.'

Answer Strategy

Tests negotiation, influence, and practical application of the Data Minimization principle. Use the STAR (Situation, Task, Action, Result) method. Focus on finding a compliant alternative that achieved the core business objective. Sample Answer: 'Situation: A marketing team wanted to collect and retain full birthdates for a hyper-personalized birthday campaign. Task: My role was to advise this created excess risk under GDPR's minimization principle. Action: I facilitated a workshop proposing a compromise: we would collect only the birth month and day, not the year, reducing identifiability. We also designed a two-stage process where the year could be optionally provided later, with a clear purpose limitation statement. Result: The team launched the campaign with a minimally invasive data set, meeting the core objective while reducing our compliance risk, and we documented the rationale in our DPIA.'