How do you approach testing for data privacy and GDPR compliance?

GDPR
data privacy
compliance testing

Your answer

Answer it first, then compare. Nothing here is saved or scored.

Model answer

Test areas: (1) Consent: verify opt-in flows work, preferences are saved, and data collection respects consent. (2) Right to access: verify data export contains all user data. (3) Right to deletion: verify account deletion removes all personal data (including backups and logs). (4) Data minimization: verify only necessary data is collected. (5) Cookie consent: verify no tracking before consent. (6) Third-party data sharing: verify data is not sent to analytics/marketing services without consent. (7) Data breach notification: verify incident response process is testable. Use automated compliance checks in CI.

What interviewers listen for

Risk-based prioritisation
You can defend skipping coverage on a path because the risk maths supports it.
Test design fluency
You apply equivalence partitioning and decision tables to concrete inputs in real time.
Metric judgment
You distinguish between metrics that drive learning and metrics that drive theatre.
Strategy under constraint
You can produce a defensible plan when the team has half the time and twice the scope.

See all 33 methodology questions