Privacy & Compliance · Study deck
GDPR Compliance for IoT
Picture a sleep band that stores movement and place.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- treat GDPR privacy principles as law rather than best-practice suggestions
- run a GDPR compliance workflow covering roles, special-category data, and breach response
- identify the failure modes that break a GDPR compliance claim
- Explain: A friendly screen is not enough if the owner cannot learn what is held, correct a wrong fact, obtain a copy, or end an unneeded use.
Major section
Start Simple
A friendly screen is not enough if the owner cannot learn what is held, correct a wrong fact, obtain a copy, or end an unneeded use.
- Fix any step that needs hidden staff knowledge.
- The law depends on role, place, data, and current guidance.
- Under the Hood explains special data, organization roles, serious failures, and where expert advice is required.
Major section
Overview: Privacy Principles as Law
The General Data Protection Regulation, usually shortened to GDPR, is an EU data protection law that applies to processing covered by Articles 2 and 3.
- Learning GDPR's shape therefore transfers: the roles, rights, and evidence habits below recur, with local variation, across many of the regimes an IoT product might need to satisfy.
- The party that decides why and how personal data is processed.
- The controller carries the main accountability for meeting the obligations.
Major section
Practitioner: The Compliance Workflow
A common practitioner mistake is to reach for consent automatically.
- Compliance becomes manageable when you run a consistent workflow for each feature that handles personal data, recording the decision at each step so the result can be demonstrated later.
- Records of processing, decisions, and controls.
- Optional extras need their own appropriate basis.
- Assess other uses separately.
Major section
Practitioner: The Compliance Workflow (continued)
Basis: genuine, withdrawable consent, off by default, so the choice is real.
- Every processing of personal data needs a lawful basis under GDPR Article 6; special-category data also needs an Article 9 condition.
- Article 22 also protects against qualifying decisions based solely on automated processing, subject to its exceptions and safeguards.
- Usage analytics are not essential.
Major section
Practitioner: The Compliance Workflow (continued)
An erasure request cannot simply be marked complete after clearing only the cloud.
- Consent must be freely given, specific, informed, and as easy to withdraw as to give, which is hard to achieve honestly on a small device.
- A thermostat needs occupancy data to provide its core feature.
- A health wearable may process Article 9 health data.
Major section
Practitioner: The Compliance Workflow (continued)
Contract may fit processing objectively necessary for a core feature covered by the contract; buying a product alone does not make every associated data use necessary.
- The IoT challenge is to find the data across a device, hub, cloud, and backups, then apply the right and any applicable exception to each store.
- Solely automated insurance-linked adjustments or access denials can make Article 22 relevant when they have legal or similarly significant effects.
- Basis: contract under Article 6(1)(b), not a consent pop-up the user cannot meaningfully refuse.
Major section
Under the Hood: Roles, Special Data, Breaches, and Failure Modes
The relationship is governed by a contract that sets out these responsibilities.
- The deeper layer explains the responsibilities that follow from your role, the extra care some data demands, and what happens when something goes wrong.
- If notification is later, the reasons for delay must be given.
- Mechanism That Makes It Real.
Major section
Under the Hood: Roles, Special Data, Breaches, and Failure Modes (continued)
Treating this as a design obligation, checked with evidence, is what turns it from a slogan into compliance.
- The recurring theme is accountability: an obligation you cannot demonstrate is, in practice, an obligation you have not met.
- Disabled-state tests showing the default constrains behavior.
- Records of processing, decisions, and DPIAs.
Major section
Under the Hood: Roles, Special Data, Breaches, and Failure Modes (continued)
Access controls and protection mapped to sensitivity.
- A processor acts on the controller's documented instructions and must not use the data for its own purposes, must protect it, and must help the controller meet its duties.
- Working access, correction, erasure, and portability across all stores.
- Documentation an auditor can review.
Major section
Under the Hood: Roles, Special Data, Breaches, and Failure Modes (continued)
A fulfilled request that reaches device, hub, and cloud.
- A wearable that infers heart rate or sleep handles health-related data, and a home sensor may reveal religious or lifestyle patterns.
- Data that indirectly reveals special-category information can fall under Article 9 (CJEU C-184/20, OT, 2022; C-21/23, Lindenapotheke, 2024).
- Erasure that clears the cloud but leaves device and backup copies.
Deck summary
Key takeaways
A friendly screen is not enough if the owner cannot learn what is held, correct a wrong fact, obtain a copy, or end an unneeded use.
- The General Data Protection Regulation, usually shortened to GDPR, is an EU data protection law that applies to processing covered by Articles 2 and 3.
- A common practitioner mistake is to reach for consent automatically.
- Basis: genuine, withdrawable consent, off by default, so the choice is real.
- An erasure request cannot simply be marked complete after clearing only the cloud.
Retrieval practice
Recall check 1 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q1An IoT company outside Europe sells a fitness band to customers in the European Union and decides what the band collects and why. What is its likely role and exposure?
Show answer
Answer: B GDPR can reach organizations outside Europe that offer goods or services to people in the EU, and the party deciding why and how is the controller.
Retrieval practice
Recall check 2 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q2A team wants to use consent as the lawful basis for the core function of a device that the customer cannot use without it. Why is this often the wrong choice?
Show answer
Answer: C Consent needs a real choice.
Retrieval practice
Recall check 3 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q3A user exercises the right to erasure. The team deletes the cloud record but leaves copies on the device and in backups. Why does this fall short, and what is the fix?
Show answer
Answer: A Where Article 17 applies, clearing only the cloud does not address personal data the controller still controls on devices or in backups; document applicable exceptions and backup handling.
Print reference
Answers
Answer key.
- B · GDPR can reach organizations outside Europe that offer goods or services to people in the EU, and the party deciding why and how is the controller.
- C · Consent needs a real choice.
- A · Where Article 17 applies, clearing only the cloud does not address personal data the controller still controls on devices or in backups; document applicable exceptions and backup handling.