Data, Records, and Confidentiality Management
Data, Records, and Confidentiality Management
This domain covers how information is protected, retained, and shared. Candidates must understand confidentiality obligations, data protection principles, recordkeeping requirements, and information-sharing controls. Questions test whether you know who may access what, for how long, and under what conditions.
Data protection principles typically include lawful and fair processing, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. A frequent trap is assuming consent is always the required legal basis; other bases (legal obligation, legitimate interest, contract) may apply, and consent must be freely given, specific, informed, and withdrawable.
Recordkeeping questions test retention periods, completeness, retrievability, and legal hold. When litigation or investigation is reasonably anticipated, retention obligations override routine deletion. A trap is destroying records under a routine retention schedule during a hold.
Confidentiality and information sharing require need-to-know access, controls on cross-border transfers, and careful handling of customer and employee data. Sharing with regulators is generally permitted or required; sharing with third parties needs a lawful basis and appropriate safeguards.
Worked example / rule of thumb: A team wants to share customer data with a vendor for analytics. Verify the lawful basis, minimize the data, execute appropriate contractual safeguards, restrict cross-border transfer, and document the decision. Rule of thumb: collect only what you need, keep it only as long as required, protect it, and be able to explain why you hold it.
Expect questions on data subject rights, breach notification timelines, and the interaction between confidentiality and regulatory disclosure duties.