I85PREP
⌘ K
CSA study materials
CSA study resources

CSA (Other exams): Data Protection, Cryptography, and Privacy

CSA · Work through your exam, one topic at a time.

All guide sections

Data Protection, Cryptography, and Privacy

This domain tests classification and lifecycle handling, algorithm and key-management choices, and privacy obligations. Expect questions that distinguish tokenization, masking, hashing, and encryption, and that probe whether keys - not just ciphertext - are controlled.

Classification and lifecycle

Classification drives handling: public, internal, confidential, restricted/regulated. Lifecycle spans create, store, use, share, archive, destroy, with retention schedules and defensible destruction (crypto-shredding where physical destruction is impractical). The tools differ: tokenization removes data from scope but puts the vault in scope; masking keeps data usable for testing; encryption preserves the data but makes key custody the control.

Algorithm choices

  • Symmetric: AES-256-GCM or ChaCha20-Poly1305 (AEAD) for bulk data; never ECB.
  • Asymmetric: RSA of at least 3072 bits, or ECDSA/EdDSA at P-256 and above; ECDH for key agreement.
  • Hashing: SHA-256/384/512, SHA-3. Passwords: Argon2id, scrypt, or bcrypt with salt and tuned cost.
  • Deprecated: DES/3DES, RC4, MD5, SHA-1 for collision resistance, RSA-1024, TLS below 1.2.
  • TLS 1.3 removes legacy ciphers and provides forward secrecy.

Key management

Envelope encryption: a data encryption key encrypts the data, a key encryption key in a KMS or HSM wraps it. Rotation, separation of duties, dual control, documented custody, per-tenant keys, and auditable destruction. Key compromise is data compromise; encryption without key management is theatre.

Privacy

Data minimisation, purpose limitation, storage limitation, DPIA for high-risk processing, data subject rights, cross-border transfer mechanisms, and the distinction between pseudonymisation and anonymisation (re-identification through linkage).

Worked example

A merchant tokenizes PANs at capture to shrink the CDE. Reasoning: only tokens are stored, so card data no longer resides in the merchant environment - but the tokenization service and its vault are now in scope, and the keys that produce tokens need the same protection as card data. If the vault is compromised, tokens are as good as PANs for this environment. Scope reduction holds only if the vault is isolated, segmented, and audited.

Traps

  • Encryption with no key-custody story.
  • Confusing hashing with encryption.
  • ECB mode.
  • Assuming anonymised data stays anonymous after joins.
  • Crypto-shredding without a key inventory.
  • Rotating keys without re-wrapping data keys.