Data Protection
Data Protection tests how identity data is classified, minimized, encrypted, retained, and monitored. The exam treats identity data as sensitive personal data, so controls must cover the identity store, credentials, logs, backups, and data shared with applications or partners. Data protection also covers credentials and authentication logs, not only profile fields.
Core rules and concepts
- Classify data first: public, internal, confidential, restricted. Identity attributes such as national ID, biometrics, and authentication secrets usually need the highest handling.
- Minimize collection and use: collect only attributes needed for a decision, limit access by role, and avoid copying identity data into test or analytics environments.
- Protect data in transit with TLS and at rest with encryption. Encryption is only effective when keys are managed: separation of duties, rotation, and restricted key access.
- Tokenization and masking reduce exposure. Pseudonymization replaces direct identifiers but is not anonymization if re-identification remains possible.
- Retention and deletion rules apply to accounts, logs, backups, and partner copies. Legal hold can override deletion, but it must be documented.
- DLP, database activity monitoring, and access logging detect misuse; logs must not themselves leak credentials or full identifiers.
Worked example
A customer identity store holds email, phone, hashed password, and national ID. The team classifies national ID as restricted, encrypts it with a managed key, stores only a token in the profile service, and restricts decryption to the verification service. Email and phone are confidential and masked in support screens. Logs record the token, not the national ID. The reasoning is that each control reduces exposure at a different layer: classification sets handling, tokenization limits spread, key management protects the ciphertext, and logging supports detection without creating a new leak.
Traps that cost marks
Encrypting data but storing keys beside it; masking the UI while writing full values to logs; treating pseudonymized data as anonymous; keeping old identity records indefinitely; and ignoring backups or partner copies in retention scope.