Privacy and Security Compliance and Regulatory Requirements
What this domain tests
This domain covers the legal and regulatory landscape and how an organization maps its obligations to controls. You should understand the categories of law-comprehensive privacy statutes, sector-specific rules (health, financial, education), breach-notification laws, and security frameworks-and the core privacy principles that recur across them: notice, choice/consent, purpose limitation, data minimization, access and correction, retention limits, and accountability. You do not need to memorize every statute; you need to reason about which obligation applies to which data and activity.
Concepts to master
- Data classification drives which rules apply: regulated health data, financial data, children's data, employee data, and de-identified data each carry different duties.
- Notice and consent: what must be disclosed, when consent is required versus another lawful basis, and how consent is documented and withdrawn.
- Individual rights: access, correction, deletion, and portability, with their response timelines and exceptions.
- Cross-border transfer restrictions and the safeguards (contracts, adequacy, consent) that permit them.
- Frameworks vs. law: a framework (e.g., a security control catalog) is voluntary guidance unless a regulation or contract incorporates it.
Traps
- Treating a voluntary framework as legally binding, or a legal requirement as optional.
- Applying the strictest rule to all data instead of classifying first-over-inclusion can itself create compliance and operational problems.
- Missing the interaction between laws (e.g., a state breach law and a sector rule both apply to the same incident).
- Confusing privacy obligations (use and disclosure limits) with security obligations (safeguards).
Rule of thumb
Classify the data, identify every law and contract that touches it, then apply the most protective requirement where they overlap-and document the mapping.
Worked example: A clinic wants to email appointment reminders. The correct analysis classifies the data as regulated health information, checks the applicable sector rule and state law, confirms the patient's communication preference, and selects a secure channel-rather than defaulting to ordinary email.