Data Security and Privacy
Data Security and Privacy tests how you protect data across its lifecycle and how you honour obligations to the people it describes. Expect classification, access control models, encryption and de-identification techniques, privacy principles and impact assessments, retention, and incident response.
Protect by classification and control
Classify every data set - public, internal, confidential, restricted - and let classification drive controls. RBAC grants by role; ABAC evaluates attributes such as region, purpose and clearance, enabling finer purpose-based restriction. Least privilege, separation of duties and periodic recertification of entitlements are the operational core. Encryption protects data at rest and in transit, but key management - rotation, and separating key custodian from data custodian - determines whether it holds.
De-identification and privacy
- Pseudonymisation: identifiers replaced with tokens and a re-identification map retained - still personal data under most regimes.
- Anonymisation: irreversible, with no reasonable re-identification, accounting for linkage attacks and quasi-identifiers such as postcode, birth date and gender.
- k-anonymity requires each quasi-identifier combination to cover at least k records; l-diversity and differential privacy address homogeneity and aggregate disclosure.
- Privacy principles in practice: lawful basis, purpose limitation, minimisation, accuracy, storage limitation, integrity, accountability. A DPIA is triggered by high-risk processing - large-scale sensitive data, systematic monitoring, profiling.
Worked example
A team wants to release a customer data set to a research partner for churn modelling. Reasoning: identifiers are removed, but postcode, birth year and gender are quasi-identifiers that can single out individuals. Apply k-anonymity with k = 5 by generalising postcode to district and birth year to five-year bands, then verify the smallest equivalence class meets the threshold. Minimise columns to those the model needs, keep the link file inside the organisation under restricted access, contractually prohibit re-identification, and set a retention date with deletion evidence. Record the DPIA outcome and the decision owner.
Traps that cost marks
- Calling pseudonymised data anonymous.
- Ignoring quasi-identifiers and linkage risk.
- Granting broad access temporarily without an expiry.
- Treating a privacy notice as a substitute for a lawful basis.
- Forgetting backups and downstream copies in retention and deletion scope.