Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Privacy Governance and Data Protection Principles
Privacy versus security
Data protection principles
The privacy program
Example. A new marketing app was ready to launch, collecting location data every five minutes. A late privacy impact assessment found no lawful basis for continuous tracking. Redesigning it cost three months; an assessment at design would have cost a week.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Collecting more data than needed | Breaches data minimisation |
| When to do a privacy impact assessment | During design, before processing starts |
| Relationship between privacy and security | Security is necessary but not sufficient |
| Who is accountable for personal data | The controller (the organisation) |
In short
- Security protects data; privacy asks whether the organisation should collect and use it at all, and how.
- Core principles include lawfulness, purpose limitation, minimisation, accuracy, storage limitation, security and accountability.
- A privacy program covers records of processing, notices, impact assessments, individuals' rights, processors and breach response.
- Privacy impact assessments are done before high-risk processing starts.
- Privacy risk is a business risk with legal, financial and reputational impact.
Exam traps
- Assuming strong security means privacy obligations are met.
- Collecting data 'in case it's useful later'.
- Doing a privacy impact assessment after launch.
- Forgetting processors and cross-border transfers.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Privacy versus security
Data protection principles
The privacy program
ExampleA new marketing app was ready to launch, collecting location data every five minutes. A late privacy impact assessment found no lawful basis for continuous tracking. Redesigning it cost three months; an assessment at design would have cost a week.
1 / 7