Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Privacy and Data Protection Governance
Privacy isn’t just security
A hospital can lock patient records in a perfect vault and still break privacy law: by collecting data it doesn’t need, using it for marketing without consent, or keeping it forever. Security asks “is the data protected?”. Privacy asks “should we have it, and are we using it as promised?”.
Privacy obligations come from laws such as GDPR, the CCPA in California, LGPD in Brazil and India’s DPDP Act, plus sector rules such as HIPAA. They’re part of the legal and regulatory requirements the security manager must understand (Domain 1A).
The privacy principles
| Principle | In plain words |
|---|---|
| Lawfulness, fairness, transparency | Have a legal reason and tell people clearly |
| Purpose limitation | Use data only for what you said |
| Data minimisation | Collect only what you need |
| Accuracy | Keep it correct |
| Storage limitation | Don’t keep it longer than needed |
| Integrity and confidentiality | Protect it properly; this is where security fits |
| Accountability | Be able to prove all of the above |
What a privacy program contains
- Records of processing: what personal data, for what purpose, where, shared with whom, kept how long.
- Notices and lawful basis: tell people what happens to their data and have a legal reason for each use.
- Privacy impact assessments (PIAs / DPIAs) before high-risk processing starts.
- Individuals’ rights: processes for access, correction, deletion and objection requests, on time.
- Processors and transfers: contracts with processors; safeguards for cross-border transfers.
- Security and breach response: appropriate protection, and notification within legal deadlines.
Who does what
The privacy officer or data protection officer (DPO) leads privacy: lawful basis, notices, rights, impact assessments and the privacy regulator. The security manager provides the protection (access control, encryption, monitoring), contributes security analysis to impact assessments and leads incident detection and response. Legal interprets the law. The organisation, as controller, stays accountable even when a processor causes a breach.
Privacy by design
Privacy by design and by default builds protection into systems from the start, with the most protective settings as standard. Common privacy-enhancing techniques:
- Minimisation: collect and keep only what’s needed.
- Pseudonymisation: replace identifiers. The data is still personal data, but lower risk.
- Anonymisation: irreversibly remove identity, so the data falls outside privacy law. True anonymisation is hard.
- Encryption and access restriction.
Example. A retailer plans a loyalty app that tracks customers’ location constantly. The privacy impact assessment, with security input, finds location is needed only at checkout. The design changes to collect it only then, cutting both privacy risk and breach exposure.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Privacy vs security | Privacy: appropriate use. Security: protection |
| Collecting more data than needed | It breaks data minimisation |
| When to do a privacy impact assessment | Before high-risk processing starts |
| Is pseudonymised data personal data? | Yes |
| The security manager’s role in privacy | Protect the data; support impact assessments and breach response |
In short
- Privacy is about whether personal data should be collected, how it's used and shared, and people's rights over it; security is one of the means to protect it.
- Privacy laws such as GDPR rest on principles: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.
- A privacy program includes records of processing, notices, lawful bases, privacy impact assessments, rights handling, processor contracts, transfer safeguards and breach response.
- The privacy officer or DPO leads privacy; the security manager provides the protection and contributes to impact assessments and breaches.
- Privacy by design and by default builds protection into systems from the start, with the most protective settings as standard.
- Privacy-enhancing techniques include minimisation, pseudonymisation, anonymisation, encryption and access restriction.
Exam traps
- A perfectly secure system can still break privacy law if it collects data it doesn't need.
- Pseudonymised data is still personal data; only truly anonymised data falls outside privacy law.
- Privacy impact assessments happen before processing starts, not after.
- The controller stays accountable even when a processor causes the breach.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The privacy principles
What a privacy program contains
Who does what