Top 3 Gdpr Interview Questions
Browse 3 real-world technical and behavioral interview questions about Gdpr. Review scenarios, edge cases, and architectural best practices.
An erasure request arrives and the person's data is in backups, an event stream, a warehouse copy and a training set. What can you honestly delete?
You delete from the operational store, propagate to every derived copy you can enumerate, and for the copies you cannot rewrite you rely on crypto-shredding, keyed compaction, snapshot expiry and exclusion at the next retrain.
A GDPR erasure request arrives for a patient whose data sits in an append-only clinical audit log. What do you do?
You do not delete first. Erasure is a qualified right that yields where other law requires retention, so you triage each dataset by its lawful basis, erase what has no basis to be kept, suppress and restrict what must be retained, and put the residual judgement to legal and records management.
Fraud and AML say keep it for years, privacy says delete it. How do you build a system that satisfies both?
Treat the two obligations as different purposes over different columns rather than a fight over one table. Keep the narrow set you are compelled to retain in a restricted, purpose-locked store the product cannot read, delete everything else on schedule, and make your compliance function name the retained fields.