Data Privacy and Security

Privacy vs. Security

While related, privacy and security are distinct concepts that work together to protect data:

• Privacy: Ensuring appropriate use of personal information—who can use data and for what purposes
• Security: Protecting data from unauthorized access, use, or disclosure—keeping data safe from threats

You can have security without privacy (data is protected but used inappropriately), but you cannot have privacy without security (data must be protected to ensure appropriate use).

Privacy by Design

Privacy by Design (PbD) is an approach that embeds privacy into the design and operation of systems, business practices, and physical infrastructure from the start.

Seven Foundational Principles

1. Proactive not Reactive; Preventative not Remedial

Anticipate and prevent privacy invasions before they happen.

2. Privacy as the Default Setting

Ensure maximum privacy protection automatically, without user action.

3. Privacy Embedded into Design

Build privacy into systems and practices, not added as afterthought.

4. Full Functionality (Positive-Sum)

Accommodate all legitimate interests without trade-offs.

5. End-to-End Security

Protect data throughout entire lifecycle from collection to deletion.

6. Visibility and Transparency

Keep operations visible and subject to verification.

7. Respect for User Privacy

Keep interests of individuals paramount with strong defaults and user control.

Privacy Protection Strategies

Data Minimization

• Collect only data necessary for specific purpose
• Avoid "just in case" data collection
• Regular review of data collection practices
• Delete data when no longer needed

Purpose Limitation

• Define specific, legitimate purposes for data processing
• Use data only for stated purposes
• Obtain new consent for new purposes
• Document purpose for each data element

Anonymization and Pseudonymization

• Anonymization: Remove identifying information permanently (irreversible)
• Pseudonymization: Replace identifying information with pseudonyms (reversible with key)
• Use for analytics, testing, and development
• Reduce risk of re-identification

Consent Management

• Informed: Clear explanation of what, why, and how
• Specific: Separate consent for different purposes
• Freely Given: No coercion or negative consequences
• Revocable: Easy to withdraw consent
• Document all consent decisions

Data Security Framework

CIA Triad

The foundation of information security:

• Confidentiality: Prevent unauthorized disclosure
• Integrity: Prevent unauthorized modification
• Availability: Ensure authorized access when needed

Security Controls

Administrative Controls

• Security Policies: Document security requirements and standards
• Security Training: Educate staff on security practices
• Background Checks: Verify trustworthiness of personnel
• Separation of Duties: No single person controls entire process
• Incident Response Plan: Procedures for handling security incidents
• Business Continuity: Ensure operations continue after disruption

Technical Controls

Encryption

• Data at Rest: Encrypt stored data (AES-256)
• Data in Transit: Encrypt communications (TLS 1.3)
• End-to-End Encryption: Data encrypted from sender to recipient
• Key Management: Secure generation, storage, and rotation of encryption keys

Access Controls

• Authentication: Verify user identity (multi-factor authentication)
• Authorization: Control what authenticated users can do
• Least Privilege: Minimum access necessary for job function
• Role-Based Access: Permissions based on role, not individual
• Access Reviews: Regular certification of access rights

Network Security

• Firewalls: Control network traffic between security zones
• Network Segmentation: Isolate sensitive systems
• Intrusion Detection/Prevention: Monitor and block malicious activity
• VPN: Secure remote access
• DDoS Protection: Defend against denial of service attacks

Application Security

• Secure Coding: Follow security best practices in development
• Input Validation: Prevent injection attacks
• Session Management: Secure user sessions
• Security Testing: SAST, DAST, penetration testing
• Patch Management: Keep software up to date

Monitoring and Logging

• Security Information and Event Management (SIEM): Centralize and analyze logs
• Audit Trails: Record all data access and changes
• Anomaly Detection: Identify unusual behavior
• Log Retention: Maintain logs for investigation and compliance

Physical Controls

• Physical Access Control: Restrict access to facilities and equipment
• Surveillance: Monitor physical access points
• Environmental Controls: Protect against fire, water, temperature
• Equipment Security: Secure disposal, locked cabinets

Data Classification and Protection

Classification Levels

• Public: No harm if disclosed (marketing materials, public reports)
• Internal: Limited harm if disclosed (internal memos, policies)
• Confidential: Significant harm if disclosed (customer data, trade secrets)
• Restricted: Severe harm if disclosed (regulated data, executive communications)

Classification-Based Controls

Privacy Impact Assessments

Systematic evaluation of privacy risks in new projects or systems.

When to Conduct PIA

• New data collection initiatives
• New systems processing personal data
• Significant changes to existing systems
• New data sharing arrangements
• High-risk processing activities

PIA Process

1. Describe Processing: What data, why, how, who
2. Assess Necessity: Is processing necessary and proportionate?
3. Identify Risks: What privacy risks exist?
4. Evaluate Mitigations: How will risks be addressed?
5. Document Decisions: Record assessment and decisions
6. Review and Approve: DPO/privacy team approval
7. Monitor: Ongoing risk monitoring

Incident Response

Incident Response Plan

1. Preparation: Establish team, tools, procedures
2. Detection: Identify potential security incident
3. Containment: Limit damage and prevent spread
4. Investigation: Determine scope, cause, impact
5. Eradication: Remove threat and vulnerabilities
6. Recovery: Restore systems and operations
7. Post-Incident: Lessons learned, improvements

Breach Notification

Most regulations require notification of affected individuals and authorities:

• Internal Notification: Immediately alert incident response team
• Assessment: Determine if notification required (risk assessment)
• Authority Notification: Report to regulators within deadline (e.g., 72 hours for GDPR)
• Individual Notification: Notify affected individuals without undue delay
• Documentation: Maintain records of breach and response

In the next chapter, we'll explore access control and metadata management—two critical components for discovering, understanding, and controlling data across the organization.