For those who work with data processing, compliance, security, legal, etc., the creation of the EU’s General Data Protection Regulations (GDPR) had major impact in how user data of European citizens is handled. From the Microsoft Security side, it also meant a lot of work around product development, messaging, and training for data processing and sharing ahead of the May 2018 implementation.
I came up with GDPaRty, the GDPR Drinking game, for two reasons: 1. To put a fun spin on GDPR for my colleagues (who were doing a lot of work around it already), and 2. To introduce GDPR to friends who weren’t familiar with the new rules and regulations.
The game is loosely based on “King’s Cup” (a drinking game), with a deck of cards, face-down, encircling a bottle or can of beverage of choice and with a group of 4+ people taking turns pulling cards from the pile. It’s designed to be fun and informative, and was particularly enjoyed by friends in the legal or data compliance fields. In 2019 I even designed decks of “Official GDPaRty™” cards, printing 100 custom decks with Shuffled Ink (www.shuffledink.com). It was good insight in how to trademark brand names with the United States Patent and Trademark Office and even setting up an Etsy store to sell and distribute a few of the decks.
As we approach three years since GDPR went live, and as more data protection regulations like CCPA go into law, I wanted to share out the GDPaRty rules for anyone who may want to play it or modify it themselves -
Without further ado… Here are the rules for GDPaRty™: The GDPR Drinking Game!
| Card | Rules |
| Ace | Regulatory Announcement! Stand up and give a 60 second speech on any topic in a European accent of your choice! |
| King | Data Protection Officer Make a rule. All players must obey this rule for the rest of the game. |
| Queen | Data Processor For the next round, you only communicate through hand motions and miming. |
| Jack | Data Breach! You choose: share a secret or finish your drink |
| 10 | Pseudonymization Rename one other player for the remainder of the game. All players must address them by their new name - or drink! |
| 9 | Right in Relation to Automated Decision Making and Profiling Choose another player to drink whenever you drink. |
| 8 | Right to Object Ignore any rules that are currently in play for one round. |
| 7 | Right to Data Portability Play a round of Telephone. If the end phrase is different than the initial phrase, everyone drinks. |
| 6 | Right to Restrict Processing Touch the ground! Last person to touch the ground must drink. |
| 5 | Right to Erasure Choose a word to “erase” for the rest of the game. Anytime someone says that word, they must drink. |
| 4 | Right to Rectification Play 2 Truths and a Lie. You tell three stories: two true, one lie, and other players guess which is the lie. Everyone who guesses incorrectly must drink; for every person who is correct, you take a drink. |
| 3 | Right of Access Play a Round of “Questions”. Whoever loses must drink. |
| 2 | Right to be Informed Give one “Never Have I Ever”. State something you have never done. Anyone who has done the activity must drink. |
