DAPLE (C1) cheat sheet

GDPR lawful bases (Art. 6): consent, contract, legal obligation, vital interests, public task, legitimate interests - at least one must apply to every processing activity.

GDPR special categories (Art. 9) require a separate Art. 9 condition on top of an Art. 6 basis; examples include health, biometrics for identification, and trade-union membership.

Controller determines purposes and means; processor acts on documented instructions. Joint controllers (Art. 26) allocate responsibilities but each remains liable to data subjects.

Territorial scope (Art. 3): establishment-based applies to processing in the context of an EU establishment; targeting-based applies to offering goods/services to, or monitoring, EU data subjects.

Data subject rights timeline: one month to respond, extendable by two further months for complex requests; generally free of charge.

Breach notification: 72 hours to the supervisory authority after awareness unless unlikely to result in risk; notify data subjects without undue delay when high risk.

Administrative fines under GDPR reach 20 million EUR or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

A DPIA is required where processing is likely to result in high risk, notably systematic monitoring, large-scale special categories, or new technology; consult the authority if residual risk stays high.

Core principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

Accountability requires demonstrable evidence - records of processing, policies, DPIAs, training logs - not merely intent to comply.

Privacy governance structure: board-level owner, DPO or privacy lead, a network of business-unit privacy champions, and a documented decision-escalation path.

Records of Processing Activities (RoPA) content: purposes, categories of data and data subjects, recipients, third-country transfers, retention periods, security measures.

Retention schedules set a defined trigger (contract end, consent withdrawal, statutory period) plus a disposal method; indefinite retention is a finding.

DPO independence: the DPO reports to the highest management level, is not instructed on how to perform the role, and cannot be dismissed for performing it.

Privacy metrics that are auditable include DPIA completion rate, rights-request cycle time, breach mean time to detect, and vendor assessment coverage.

Classification tiers commonly run Public, Internal, Confidential, Restricted; the top tier maps to special categories, credentials, and financial account data.

Classification label drives handling rules: storage location, encryption requirement, sharing approval level, retention, and disposal method.

Data inventory records each data element, its source system, owner, classification, and downstream recipients; a data map adds the flow between them.

Data-flow mapping captures cross-border hops, processor hand-offs, and shadow IT; discovery tools (DLP, CASB, database scanners) feed the inventory.

Structured vs unstructured: structured lives in databases with schema; unstructured (documents, email, images) is the usual blind spot in mapping exercises.

Metadata to capture per asset: system owner, hosting location, retention rule, lawful basis, access group, and cross-border transfer mechanism.

Inventory decay is real: set a review cadence (typically annual or on material change) and tie updates to change-management tickets.

Defence in depth layers: perimeter, network segmentation, host hardening, application controls, data-level controls, monitoring.

Control families: preventive, detective, corrective; map each to a threat so the control set is justified rather than inherited.

Zero trust removes implicit network trust: every request is authenticated and authorised per session, with least privilege and continuous verification.

Segregation of duties and least privilege limit insider risk; break-glass accounts require logging, time-boxing, and post-use review.

Logging and monitoring: centralise logs, protect them from tampering, set retention aligned to legal hold and investigation needs, alert on anomalous data access.

Data-at-rest controls include full-disk encryption, database encryption, tokenisation, and masking in non-production environments.

Resilience controls: tested backups, immutable copies, and a documented recovery time objective tied to the criticality of each data store.

Symmetric (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is used for key exchange and signatures. Hybrid schemes combine both.

AES key sizes: 128, 192, 256 bits. RSA keys below 2048 bits are deprecated; 3072-bit or ECC P-256 are common current baselines.

Modes matter: use authenticated encryption (GCM, or CBC with a separate MAC). ECB leaks patterns and must not be used for structured data.

Hashing (SHA-256/384) is one-way; password storage requires a salted, slow KDF such as Argon2, scrypt, bcrypt, or PBKDF2.

Key lifecycle: generation in a validated source of randomness, distribution, storage, rotation, retirement, destruction - each step logged.

Key management separation: keys stored separately from the data they protect; HSM or KMS holds root keys; envelope encryption wraps data keys.

Crypto-agility: design so algorithms and key lengths can be swapped, which is required to migrate away from deprecated primitives and toward post-quantum options.

Access control models: RBAC (role-based), ABAC (attribute-based), and ReBAC (relationship-based); ABAC and ReBAC scale better for fine-grained data decisions.

Authentication factors: something you know, have, are. MFA requires two distinct factor types; two passwords are not MFA.

SSO via SAML or OIDC centralises authentication; authorisation is enforced separately at the resource, not assumed from the token.

Least privilege and just-in-time elevation: standing admin rights are a finding; time-boxed elevation with approval and logging is preferred.

Periodic access reviews (attestation) confirm each user's entitlements; orphaned and dormant accounts are removed on a defined schedule.

Password guidance: length over complexity, block breached passwords, no forced periodic rotation absent evidence of compromise.

Privileged access management: vault credentials, session recording, and separation of the identity provider from the resource being protected.

IR lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

Breach decision test: does the event involve personal data, and does it result in a risk to rights and freedoms? Document the reasoning either way.

Notification clocks run from awareness, not from confirmation of full scope; the 72-hour GDPR clock can be met with a phased notification.

Processor obligations: notify the controller without undue delay after becoming aware; the controller owns the authority and subject notifications.

Forensic readiness: preserve volatile data first, maintain chain of custody, hash evidence, and keep an incident log with timestamps in UTC.

Containment options trade evidence against spread: isolate hosts at the network layer rather than powering off, to preserve memory artefacts.

Post-incident: root-cause analysis, control remediation tracked to closure, and updates to the DPIA and RoPA where processing changed.

Due diligence tiers by data sensitivity and access level: questionnaires, evidence review, and on-site or independent assurance for high-risk vendors.

Contract clauses for processors (Art. 28): subject matter, duration, nature and purpose, instructions, confidentiality, security, sub-processor rules, assistance, deletion, audit.

Cross-border transfer mechanisms: adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, and derogations for occasional transfers.

Transfer impact assessment examines the destination legal regime, access by public authorities, and whether supplementary technical measures (encryption, pseudonymisation) close the gap.

Sub-processor management: prior authorisation or general authorisation with notice and objection rights; flow-down of equivalent obligations.

Continuous monitoring: certification expiry, breach history, financial health, and concentration risk across the vendor portfolio.

Exit planning: data return and deletion confirmation, format, transition assistance, and escrow for critical services.

Privacy by design principles: proactive not reactive, privacy as default, embedded into design, full functionality (positive-sum), end-to-end security, visibility and transparency, respect for user privacy.

Data protection by design and by default (Art. 25) requires technical and organisational measures plus default settings that minimise data collection and access.

PETs: differential privacy (noise calibrated to epsilon), secure multi-party computation, homomorphic encryption, federated learning, synthetic data.

Pseudonymisation reduces risk but data remains personal; anonymisation must be irreversible against re-identification, including linkage attacks.

AI systems: document training-data provenance, test for bias, provide meaningful explanation, and assess whether outputs infer special-category data.

IoT and location data: minimise collection frequency, aggregate at the edge, and treat device identifiers as personal data when linkable.

Privacy engineering artefacts: threat model, data-flow diagram, DPIA, retention code, consent-state model, and automated deletion jobs.

GDPR lawful bases (Art. 6): consent, contract, legal obligation, vital interests, public task, legitimate interests - at least one must apply to every processing activity.

GDPR special categories (Art. 9) require a separate Art. 9 condition on top of an Art. 6 basis; examples include health, biometrics for identification, and trade-union membership.

Controller determines purposes and means; processor acts on documented instructions. Joint controllers (Art. 26) allocate responsibilities but each remains liable to data subjects.

Territorial scope (Art. 3): establishment-based applies to processing in the context of an EU establishment; targeting-based applies to offering goods/services to, or monitoring, EU data subjects.

Data subject rights timeline: one month to respond, extendable by two further months for complex requests; generally free of charge.

Breach notification: 72 hours to the supervisory authority after awareness unless unlikely to result in risk; notify data subjects without undue delay when high risk.

Administrative fines under GDPR reach 20 million EUR or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

A DPIA is required where processing is likely to result in high risk, notably systematic monitoring, large-scale special categories, or new technology; consult the authority if residual risk stays high.

Core principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

Accountability requires demonstrable evidence - records of processing, policies, DPIAs, training logs - not merely intent to comply.

Privacy governance structure: board-level owner, DPO or privacy lead, a network of business-unit privacy champions, and a documented decision-escalation path.

Records of Processing Activities (RoPA) content: purposes, categories of data and data subjects, recipients, third-country transfers, retention periods, security measures.

Retention schedules set a defined trigger (contract end, consent withdrawal, statutory period) plus a disposal method; indefinite retention is a finding.

DPO independence: the DPO reports to the highest management level, is not instructed on how to perform the role, and cannot be dismissed for performing it.

Privacy metrics that are auditable include DPIA completion rate, rights-request cycle time, breach mean time to detect, and vendor assessment coverage.

Classification tiers commonly run Public, Internal, Confidential, Restricted; the top tier maps to special categories, credentials, and financial account data.

Classification label drives handling rules: storage location, encryption requirement, sharing approval level, retention, and disposal method.

Data inventory records each data element, its source system, owner, classification, and downstream recipients; a data map adds the flow between them.

Data-flow mapping captures cross-border hops, processor hand-offs, and shadow IT; discovery tools (DLP, CASB, database scanners) feed the inventory.

Structured vs unstructured: structured lives in databases with schema; unstructured (documents, email, images) is the usual blind spot in mapping exercises.

Metadata to capture per asset: system owner, hosting location, retention rule, lawful basis, access group, and cross-border transfer mechanism.

Inventory decay is real: set a review cadence (typically annual or on material change) and tie updates to change-management tickets.

Defence in depth layers: perimeter, network segmentation, host hardening, application controls, data-level controls, monitoring.

Control families: preventive, detective, corrective; map each to a threat so the control set is justified rather than inherited.

Zero trust removes implicit network trust: every request is authenticated and authorised per session, with least privilege and continuous verification.

Segregation of duties and least privilege limit insider risk; break-glass accounts require logging, time-boxing, and post-use review.

Logging and monitoring: centralise logs, protect them from tampering, set retention aligned to legal hold and investigation needs, alert on anomalous data access.

Data-at-rest controls include full-disk encryption, database encryption, tokenisation, and masking in non-production environments.

Resilience controls: tested backups, immutable copies, and a documented recovery time objective tied to the criticality of each data store.

Symmetric (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is used for key exchange and signatures. Hybrid schemes combine both.

AES key sizes: 128, 192, 256 bits. RSA keys below 2048 bits are deprecated; 3072-bit or ECC P-256 are common current baselines.

Modes matter: use authenticated encryption (GCM, or CBC with a separate MAC). ECB leaks patterns and must not be used for structured data.

Hashing (SHA-256/384) is one-way; password storage requires a salted, slow KDF such as Argon2, scrypt, bcrypt, or PBKDF2.

Key lifecycle: generation in a validated source of randomness, distribution, storage, rotation, retirement, destruction - each step logged.

Key management separation: keys stored separately from the data they protect; HSM or KMS holds root keys; envelope encryption wraps data keys.

Crypto-agility: design so algorithms and key lengths can be swapped, which is required to migrate away from deprecated primitives and toward post-quantum options.

Access control models: RBAC (role-based), ABAC (attribute-based), and ReBAC (relationship-based); ABAC and ReBAC scale better for fine-grained data decisions.

Authentication factors: something you know, have, are. MFA requires two distinct factor types; two passwords are not MFA.

SSO via SAML or OIDC centralises authentication; authorisation is enforced separately at the resource, not assumed from the token.

Least privilege and just-in-time elevation: standing admin rights are a finding; time-boxed elevation with approval and logging is preferred.

Periodic access reviews (attestation) confirm each user's entitlements; orphaned and dormant accounts are removed on a defined schedule.

Password guidance: length over complexity, block breached passwords, no forced periodic rotation absent evidence of compromise.

Privileged access management: vault credentials, session recording, and separation of the identity provider from the resource being protected.

IR lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

Breach decision test: does the event involve personal data, and does it result in a risk to rights and freedoms? Document the reasoning either way.

Notification clocks run from awareness, not from confirmation of full scope; the 72-hour GDPR clock can be met with a phased notification.

Processor obligations: notify the controller without undue delay after becoming aware; the controller owns the authority and subject notifications.

Forensic readiness: preserve volatile data first, maintain chain of custody, hash evidence, and keep an incident log with timestamps in UTC.

Containment options trade evidence against spread: isolate hosts at the network layer rather than powering off, to preserve memory artefacts.

Post-incident: root-cause analysis, control remediation tracked to closure, and updates to the DPIA and RoPA where processing changed.

Due diligence tiers by data sensitivity and access level: questionnaires, evidence review, and on-site or independent assurance for high-risk vendors.

Contract clauses for processors (Art. 28): subject matter, duration, nature and purpose, instructions, confidentiality, security, sub-processor rules, assistance, deletion, audit.

Cross-border transfer mechanisms: adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, and derogations for occasional transfers.

Transfer impact assessment examines the destination legal regime, access by public authorities, and whether supplementary technical measures (encryption, pseudonymisation) close the gap.

Sub-processor management: prior authorisation or general authorisation with notice and objection rights; flow-down of equivalent obligations.

Continuous monitoring: certification expiry, breach history, financial health, and concentration risk across the vendor portfolio.

Exit planning: data return and deletion confirmation, format, transition assistance, and escrow for critical services.

Privacy by design principles: proactive not reactive, privacy as default, embedded into design, full functionality (positive-sum), end-to-end security, visibility and transparency, respect for user privacy.

Data protection by design and by default (Art. 25) requires technical and organisational measures plus default settings that minimise data collection and access.

PETs: differential privacy (noise calibrated to epsilon), secure multi-party computation, homomorphic encryption, federated learning, synthetic data.

Pseudonymisation reduces risk but data remains personal; anonymisation must be irreversible against re-identification, including linkage attacks.

AI systems: document training-data provenance, test for bias, provide meaningful explanation, and assess whether outputs infer special-category data.

IoT and location data: minimise collection frequency, aggregate at the edge, and treat device identifiers as personal data when linkable.

Privacy engineering artefacts: threat model, data-flow diagram, DPIA, retention code, consent-state model, and automated deletion jobs.

GDPR lawful bases (Art. 6): consent, contract, legal obligation, vital interests, public task, legitimate interests - at least one must apply to every processing activity.

GDPR special categories (Art. 9) require a separate Art. 9 condition on top of an Art. 6 basis; examples include health, biometrics for identification, and trade-union membership.

Controller determines purposes and means; processor acts on documented instructions. Joint controllers (Art. 26) allocate responsibilities but each remains liable to data subjects.

Territorial scope (Art. 3): establishment-based applies to processing in the context of an EU establishment; targeting-based applies to offering goods/services to, or monitoring, EU data subjects.

Data subject rights timeline: one month to respond, extendable by two further months for complex requests; generally free of charge.

Breach notification: 72 hours to the supervisory authority after awareness unless unlikely to result in risk; notify data subjects without undue delay when high risk.

Administrative fines under GDPR reach 20 million EUR or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

A DPIA is required where processing is likely to result in high risk, notably systematic monitoring, large-scale special categories, or new technology; consult the authority if residual risk stays high.

Core principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

Accountability requires demonstrable evidence - records of processing, policies, DPIAs, training logs - not merely intent to comply.

Privacy governance structure: board-level owner, DPO or privacy lead, a network of business-unit privacy champions, and a documented decision-escalation path.

Records of Processing Activities (RoPA) content: purposes, categories of data and data subjects, recipients, third-country transfers, retention periods, security measures.

Retention schedules set a defined trigger (contract end, consent withdrawal, statutory period) plus a disposal method; indefinite retention is a finding.

DPO independence: the DPO reports to the highest management level, is not instructed on how to perform the role, and cannot be dismissed for performing it.

Privacy metrics that are auditable include DPIA completion rate, rights-request cycle time, breach mean time to detect, and vendor assessment coverage.

Classification tiers commonly run Public, Internal, Confidential, Restricted; the top tier maps to special categories, credentials, and financial account data.

Classification label drives handling rules: storage location, encryption requirement, sharing approval level, retention, and disposal method.

Data inventory records each data element, its source system, owner, classification, and downstream recipients; a data map adds the flow between them.

Data-flow mapping captures cross-border hops, processor hand-offs, and shadow IT; discovery tools (DLP, CASB, database scanners) feed the inventory.

Structured vs unstructured: structured lives in databases with schema; unstructured (documents, email, images) is the usual blind spot in mapping exercises.

Metadata to capture per asset: system owner, hosting location, retention rule, lawful basis, access group, and cross-border transfer mechanism.

Inventory decay is real: set a review cadence (typically annual or on material change) and tie updates to change-management tickets.

Defence in depth layers: perimeter, network segmentation, host hardening, application controls, data-level controls, monitoring.

Control families: preventive, detective, corrective; map each to a threat so the control set is justified rather than inherited.

Zero trust removes implicit network trust: every request is authenticated and authorised per session, with least privilege and continuous verification.

Segregation of duties and least privilege limit insider risk; break-glass accounts require logging, time-boxing, and post-use review.

Logging and monitoring: centralise logs, protect them from tampering, set retention aligned to legal hold and investigation needs, alert on anomalous data access.

Data-at-rest controls include full-disk encryption, database encryption, tokenisation, and masking in non-production environments.

Resilience controls: tested backups, immutable copies, and a documented recovery time objective tied to the criticality of each data store.

Symmetric (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is used for key exchange and signatures. Hybrid schemes combine both.

AES key sizes: 128, 192, 256 bits. RSA keys below 2048 bits are deprecated; 3072-bit or ECC P-256 are common current baselines.

Modes matter: use authenticated encryption (GCM, or CBC with a separate MAC). ECB leaks patterns and must not be used for structured data.

Hashing (SHA-256/384) is one-way; password storage requires a salted, slow KDF such as Argon2, scrypt, bcrypt, or PBKDF2.

Key lifecycle: generation in a validated source of randomness, distribution, storage, rotation, retirement, destruction - each step logged.

Key management separation: keys stored separately from the data they protect; HSM or KMS holds root keys; envelope encryption wraps data keys.

Crypto-agility: design so algorithms and key lengths can be swapped, which is required to migrate away from deprecated primitives and toward post-quantum options.

Access control models: RBAC (role-based), ABAC (attribute-based), and ReBAC (relationship-based); ABAC and ReBAC scale better for fine-grained data decisions.

Authentication factors: something you know, have, are. MFA requires two distinct factor types; two passwords are not MFA.

SSO via SAML or OIDC centralises authentication; authorisation is enforced separately at the resource, not assumed from the token.

Least privilege and just-in-time elevation: standing admin rights are a finding; time-boxed elevation with approval and logging is preferred.

Periodic access reviews (attestation) confirm each user's entitlements; orphaned and dormant accounts are removed on a defined schedule.

Password guidance: length over complexity, block breached passwords, no forced periodic rotation absent evidence of compromise.

Privileged access management: vault credentials, session recording, and separation of the identity provider from the resource being protected.

IR lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

Breach decision test: does the event involve personal data, and does it result in a risk to rights and freedoms? Document the reasoning either way.

Notification clocks run from awareness, not from confirmation of full scope; the 72-hour GDPR clock can be met with a phased notification.

Processor obligations: notify the controller without undue delay after becoming aware; the controller owns the authority and subject notifications.

Forensic readiness: preserve volatile data first, maintain chain of custody, hash evidence, and keep an incident log with timestamps in UTC.

Containment options trade evidence against spread: isolate hosts at the network layer rather than powering off, to preserve memory artefacts.

Post-incident: root-cause analysis, control remediation tracked to closure, and updates to the DPIA and RoPA where processing changed.

Due diligence tiers by data sensitivity and access level: questionnaires, evidence review, and on-site or independent assurance for high-risk vendors.

Contract clauses for processors (Art. 28): subject matter, duration, nature and purpose, instructions, confidentiality, security, sub-processor rules, assistance, deletion, audit.

Cross-border transfer mechanisms: adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, and derogations for occasional transfers.

Transfer impact assessment examines the destination legal regime, access by public authorities, and whether supplementary technical measures (encryption, pseudonymisation) close the gap.

Sub-processor management: prior authorisation or general authorisation with notice and objection rights; flow-down of equivalent obligations.

Continuous monitoring: certification expiry, breach history, financial health, and concentration risk across the vendor portfolio.

Exit planning: data return and deletion confirmation, format, transition assistance, and escrow for critical services.

Privacy by design principles: proactive not reactive, privacy as default, embedded into design, full functionality (positive-sum), end-to-end security, visibility and transparency, respect for user privacy.

Data protection by design and by default (Art. 25) requires technical and organisational measures plus default settings that minimise data collection and access.

PETs: differential privacy (noise calibrated to epsilon), secure multi-party computation, homomorphic encryption, federated learning, synthetic data.

Pseudonymisation reduces risk but data remains personal; anonymisation must be irreversible against re-identification, including linkage attacks.

AI systems: document training-data provenance, test for bias, provide meaningful explanation, and assess whether outputs infer special-category data.

IoT and location data: minimise collection frequency, aggregate at the edge, and treat device identifiers as personal data when linkable.

Privacy engineering artefacts: threat model, data-flow diagram, DPIA, retention code, consent-state model, and automated deletion jobs.

GDPR lawful bases (Art. 6): consent, contract, legal obligation, vital interests, public task, legitimate interests - at least one must apply to every processing activity.

GDPR special categories (Art. 9) require a separate Art. 9 condition on top of an Art. 6 basis; examples include health, biometrics for identification, and trade-union membership.

Controller determines purposes and means; processor acts on documented instructions. Joint controllers (Art. 26) allocate responsibilities but each remains liable to data subjects.

Territorial scope (Art. 3): establishment-based applies to processing in the context of an EU establishment; targeting-based applies to offering goods/services to, or monitoring, EU data subjects.

Data subject rights timeline: one month to respond, extendable by two further months for complex requests; generally free of charge.

Breach notification: 72 hours to the supervisory authority after awareness unless unlikely to result in risk; notify data subjects without undue delay when high risk.

Administrative fines under GDPR reach 20 million EUR or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

A DPIA is required where processing is likely to result in high risk, notably systematic monitoring, large-scale special categories, or new technology; consult the authority if residual risk stays high.

Core principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

Accountability requires demonstrable evidence - records of processing, policies, DPIAs, training logs - not merely intent to comply.

Privacy governance structure: board-level owner, DPO or privacy lead, a network of business-unit privacy champions, and a documented decision-escalation path.

Records of Processing Activities (RoPA) content: purposes, categories of data and data subjects, recipients, third-country transfers, retention periods, security measures.

Retention schedules set a defined trigger (contract end, consent withdrawal, statutory period) plus a disposal method; indefinite retention is a finding.

DPO independence: the DPO reports to the highest management level, is not instructed on how to perform the role, and cannot be dismissed for performing it.

Privacy metrics that are auditable include DPIA completion rate, rights-request cycle time, breach mean time to detect, and vendor assessment coverage.

Classification tiers commonly run Public, Internal, Confidential, Restricted; the top tier maps to special categories, credentials, and financial account data.

Classification label drives handling rules: storage location, encryption requirement, sharing approval level, retention, and disposal method.

Data inventory records each data element, its source system, owner, classification, and downstream recipients; a data map adds the flow between them.

Data-flow mapping captures cross-border hops, processor hand-offs, and shadow IT; discovery tools (DLP, CASB, database scanners) feed the inventory.

Structured vs unstructured: structured lives in databases with schema; unstructured (documents, email, images) is the usual blind spot in mapping exercises.

Metadata to capture per asset: system owner, hosting location, retention rule, lawful basis, access group, and cross-border transfer mechanism.

Inventory decay is real: set a review cadence (typically annual or on material change) and tie updates to change-management tickets.

Defence in depth layers: perimeter, network segmentation, host hardening, application controls, data-level controls, monitoring.

Control families: preventive, detective, corrective; map each to a threat so the control set is justified rather than inherited.

Zero trust removes implicit network trust: every request is authenticated and authorised per session, with least privilege and continuous verification.

Segregation of duties and least privilege limit insider risk; break-glass accounts require logging, time-boxing, and post-use review.

Logging and monitoring: centralise logs, protect them from tampering, set retention aligned to legal hold and investigation needs, alert on anomalous data access.

Data-at-rest controls include full-disk encryption, database encryption, tokenisation, and masking in non-production environments.

Resilience controls: tested backups, immutable copies, and a documented recovery time objective tied to the criticality of each data store.

Symmetric (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is used for key exchange and signatures. Hybrid schemes combine both.

AES key sizes: 128, 192, 256 bits. RSA keys below 2048 bits are deprecated; 3072-bit or ECC P-256 are common current baselines.

Modes matter: use authenticated encryption (GCM, or CBC with a separate MAC). ECB leaks patterns and must not be used for structured data.

Hashing (SHA-256/384) is one-way; password storage requires a salted, slow KDF such as Argon2, scrypt, bcrypt, or PBKDF2.

Key lifecycle: generation in a validated source of randomness, distribution, storage, rotation, retirement, destruction - each step logged.

Key management separation: keys stored separately from the data they protect; HSM or KMS holds root keys; envelope encryption wraps data keys.

Crypto-agility: design so algorithms and key lengths can be swapped, which is required to migrate away from deprecated primitives and toward post-quantum options.

Access control models: RBAC (role-based), ABAC (attribute-based), and ReBAC (relationship-based); ABAC and ReBAC scale better for fine-grained data decisions.

Authentication factors: something you know, have, are. MFA requires two distinct factor types; two passwords are not MFA.

SSO via SAML or OIDC centralises authentication; authorisation is enforced separately at the resource, not assumed from the token.

Least privilege and just-in-time elevation: standing admin rights are a finding; time-boxed elevation with approval and logging is preferred.

Periodic access reviews (attestation) confirm each user's entitlements; orphaned and dormant accounts are removed on a defined schedule.

Password guidance: length over complexity, block breached passwords, no forced periodic rotation absent evidence of compromise.

Privileged access management: vault credentials, session recording, and separation of the identity provider from the resource being protected.

IR lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

Breach decision test: does the event involve personal data, and does it result in a risk to rights and freedoms? Document the reasoning either way.

Notification clocks run from awareness, not from confirmation of full scope; the 72-hour GDPR clock can be met with a phased notification.

Processor obligations: notify the controller without undue delay after becoming aware; the controller owns the authority and subject notifications.

Forensic readiness: preserve volatile data first, maintain chain of custody, hash evidence, and keep an incident log with timestamps in UTC.

Containment options trade evidence against spread: isolate hosts at the network layer rather than powering off, to preserve memory artefacts.

Post-incident: root-cause analysis, control remediation tracked to closure, and updates to the DPIA and RoPA where processing changed.

Due diligence tiers by data sensitivity and access level: questionnaires, evidence review, and on-site or independent assurance for high-risk vendors.

Contract clauses for processors (Art. 28): subject matter, duration, nature and purpose, instructions, confidentiality, security, sub-processor rules, assistance, deletion, audit.

Cross-border transfer mechanisms: adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, and derogations for occasional transfers.

Transfer impact assessment examines the destination legal regime, access by public authorities, and whether supplementary technical measures (encryption, pseudonymisation) close the gap.

Sub-processor management: prior authorisation or general authorisation with notice and objection rights; flow-down of equivalent obligations.

Continuous monitoring: certification expiry, breach history, financial health, and concentration risk across the vendor portfolio.

Exit planning: data return and deletion confirmation, format, transition assistance, and escrow for critical services.

Privacy by design principles: proactive not reactive, privacy as default, embedded into design, full functionality (positive-sum), end-to-end security, visibility and transparency, respect for user privacy.

Data protection by design and by default (Art. 25) requires technical and organisational measures plus default settings that minimise data collection and access.

PETs: differential privacy (noise calibrated to epsilon), secure multi-party computation, homomorphic encryption, federated learning, synthetic data.

Pseudonymisation reduces risk but data remains personal; anonymisation must be irreversible against re-identification, including linkage attacks.

AI systems: document training-data provenance, test for bias, provide meaningful explanation, and assess whether outputs infer special-category data.

IoT and location data: minimise collection frequency, aggregate at the edge, and treat device identifiers as personal data when linkable.

Privacy engineering artefacts: threat model, data-flow diagram, DPIA, retention code, consent-state model, and automated deletion jobs.

GDPR lawful bases (Art. 6): consent, contract, legal obligation, vital interests, public task, legitimate interests - at least one must apply to every processing activity.

GDPR special categories (Art. 9) require a separate Art. 9 condition on top of an Art. 6 basis; examples include health, biometrics for identification, and trade-union membership.

Controller determines purposes and means; processor acts on documented instructions. Joint controllers (Art. 26) allocate responsibilities but each remains liable to data subjects.

Territorial scope (Art. 3): establishment-based applies to processing in the context of an EU establishment; targeting-based applies to offering goods/services to, or monitoring, EU data subjects.

Data subject rights timeline: one month to respond, extendable by two further months for complex requests; generally free of charge.

Breach notification: 72 hours to the supervisory authority after awareness unless unlikely to result in risk; notify data subjects without undue delay when high risk.

Administrative fines under GDPR reach 20 million EUR or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

A DPIA is required where processing is likely to result in high risk, notably systematic monitoring, large-scale special categories, or new technology; consult the authority if residual risk stays high.

Core principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

Accountability requires demonstrable evidence - records of processing, policies, DPIAs, training logs - not merely intent to comply.

Privacy governance structure: board-level owner, DPO or privacy lead, a network of business-unit privacy champions, and a documented decision-escalation path.

Records of Processing Activities (RoPA) content: purposes, categories of data and data subjects, recipients, third-country transfers, retention periods, security measures.

Retention schedules set a defined trigger (contract end, consent withdrawal, statutory period) plus a disposal method; indefinite retention is a finding.

DPO independence: the DPO reports to the highest management level, is not instructed on how to perform the role, and cannot be dismissed for performing it.

Privacy metrics that are auditable include DPIA completion rate, rights-request cycle time, breach mean time to detect, and vendor assessment coverage.

Classification tiers commonly run Public, Internal, Confidential, Restricted; the top tier maps to special categories, credentials, and financial account data.

Classification label drives handling rules: storage location, encryption requirement, sharing approval level, retention, and disposal method.

Data inventory records each data element, its source system, owner, classification, and downstream recipients; a data map adds the flow between them.

Data-flow mapping captures cross-border hops, processor hand-offs, and shadow IT; discovery tools (DLP, CASB, database scanners) feed the inventory.

Structured vs unstructured: structured lives in databases with schema; unstructured (documents, email, images) is the usual blind spot in mapping exercises.

Metadata to capture per asset: system owner, hosting location, retention rule, lawful basis, access group, and cross-border transfer mechanism.

Inventory decay is real: set a review cadence (typically annual or on material change) and tie updates to change-management tickets.

Defence in depth layers: perimeter, network segmentation, host hardening, application controls, data-level controls, monitoring.

Control families: preventive, detective, corrective; map each to a threat so the control set is justified rather than inherited.

Zero trust removes implicit network trust: every request is authenticated and authorised per session, with least privilege and continuous verification.

Segregation of duties and least privilege limit insider risk; break-glass accounts require logging, time-boxing, and post-use review.

Logging and monitoring: centralise logs, protect them from tampering, set retention aligned to legal hold and investigation needs, alert on anomalous data access.

Data-at-rest controls include full-disk encryption, database encryption, tokenisation, and masking in non-production environments.

Resilience controls: tested backups, immutable copies, and a documented recovery time objective tied to the criticality of each data store.

Symmetric (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is used for key exchange and signatures. Hybrid schemes combine both.

AES key sizes: 128, 192, 256 bits. RSA keys below 2048 bits are deprecated; 3072-bit or ECC P-256 are common current baselines.

Modes matter: use authenticated encryption (GCM, or CBC with a separate MAC). ECB leaks patterns and must not be used for structured data.

Hashing (SHA-256/384) is one-way; password storage requires a salted, slow KDF such as Argon2, scrypt, bcrypt, or PBKDF2.

Key lifecycle: generation in a validated source of randomness, distribution, storage, rotation, retirement, destruction - each step logged.

Key management separation: keys stored separately from the data they protect; HSM or KMS holds root keys; envelope encryption wraps data keys.

Crypto-agility: design so algorithms and key lengths can be swapped, which is required to migrate away from deprecated primitives and toward post-quantum options.

Access control models: RBAC (role-based), ABAC (attribute-based), and ReBAC (relationship-based); ABAC and ReBAC scale better for fine-grained data decisions.

Authentication factors: something you know, have, are. MFA requires two distinct factor types; two passwords are not MFA.

SSO via SAML or OIDC centralises authentication; authorisation is enforced separately at the resource, not assumed from the token.

Least privilege and just-in-time elevation: standing admin rights are a finding; time-boxed elevation with approval and logging is preferred.

Periodic access reviews (attestation) confirm each user's entitlements; orphaned and dormant accounts are removed on a defined schedule.

Password guidance: length over complexity, block breached passwords, no forced periodic rotation absent evidence of compromise.

Privileged access management: vault credentials, session recording, and separation of the identity provider from the resource being protected.

IR lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

Breach decision test: does the event involve personal data, and does it result in a risk to rights and freedoms? Document the reasoning either way.

Notification clocks run from awareness, not from confirmation of full scope; the 72-hour GDPR clock can be met with a phased notification.

Processor obligations: notify the controller without undue delay after becoming aware; the controller owns the authority and subject notifications.

Forensic readiness: preserve volatile data first, maintain chain of custody, hash evidence, and keep an incident log with timestamps in UTC.

Containment options trade evidence against spread: isolate hosts at the network layer rather than powering off, to preserve memory artefacts.

Post-incident: root-cause analysis, control remediation tracked to closure, and updates to the DPIA and RoPA where processing changed.

Due diligence tiers by data sensitivity and access level: questionnaires, evidence review, and on-site or independent assurance for high-risk vendors.

Contract clauses for processors (Art. 28): subject matter, duration, nature and purpose, instructions, confidentiality, security, sub-processor rules, assistance, deletion, audit.

Cross-border transfer mechanisms: adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, and derogations for occasional transfers.

Transfer impact assessment examines the destination legal regime, access by public authorities, and whether supplementary technical measures (encryption, pseudonymisation) close the gap.

Sub-processor management: prior authorisation or general authorisation with notice and objection rights; flow-down of equivalent obligations.

Continuous monitoring: certification expiry, breach history, financial health, and concentration risk across the vendor portfolio.

Exit planning: data return and deletion confirmation, format, transition assistance, and escrow for critical services.

Privacy by design principles: proactive not reactive, privacy as default, embedded into design, full functionality (positive-sum), end-to-end security, visibility and transparency, respect for user privacy.

Data protection by design and by default (Art. 25) requires technical and organisational measures plus default settings that minimise data collection and access.

PETs: differential privacy (noise calibrated to epsilon), secure multi-party computation, homomorphic encryption, federated learning, synthetic data.

Pseudonymisation reduces risk but data remains personal; anonymisation must be irreversible against re-identification, including linkage attacks.

AI systems: document training-data provenance, test for bias, provide meaningful explanation, and assess whether outputs infer special-category data.

IoT and location data: minimise collection frequency, aggregate at the edge, and treat device identifiers as personal data when linkable.

Privacy engineering artefacts: threat model, data-flow diagram, DPIA, retention code, consent-state model, and automated deletion jobs.