Privacy, Security, and Compliance
What the exam tests
Privacy, Security, and Compliance tests the controls and legal roles that make ethical data use operational. Expect questions on privacy principles, controller and processor duties, data-subject rights, security safeguards, incident response, and breach notification. The key skill is mapping a fact pattern to the right obligation and control.
Core rules and concepts
- Privacy governs how personal data is collected, used, shared, and retained; security protects confidentiality, integrity, and availability. Good security is necessary but not sufficient for privacy.
- Roles matter: a controller determines purposes and means; a processor acts on documented instructions. A processor that starts deciding purposes may become a controller.
- Privacy by design and by default: embed safeguards, minimize data, restrict access, set retention, and make the privacy-protective option the default.
- Data-subject rights typically include access, correction, deletion, restriction, portability, and objection, subject to legal exceptions.
- Pseudonymization reduces identifiability but data remains personal; anonymization must be irreversible in context. Encryption protects confidentiality but does not by itself make data anonymous.
- Security baseline: least privilege, strong authentication, encryption in transit and at rest, logging, vendor due diligence, patching, incident response, and tested recovery.
- Breach notification depends on jurisdiction, data type, risk level, and timing; preserve evidence and document the decision.
Worked example
An HR analytics vendor processes employee health data for an employer. The employer likely determines purpose and is the controller; the vendor is a processor and needs a data-processing agreement with confidentiality, security, subprocessor, audit, and deletion terms. Health data is sensitive, so the employer needs a valid legal basis and a DPIA. If data moves to another country, a transfer mechanism and supplementary safeguards are needed. Security should include role-based access, encryption, and retention limits. If the vendor suffers a breach, the processor notifies the controller without undue delay; the controller assesses risk and notifies the regulator or individuals as required.
Traps that cost marks
Calling pseudonymized data anonymous. Assuming encryption satisfies all privacy duties. Missing the processor-to-controller shift. Using consent when another basis is more appropriate. Ignoring transfer and subprocessor issues. Missing notification clocks.