Foundational principles in technology
Foundations you must know
Privacy concerns the appropriate handling of personal data across its lifecycle-collection, use, sharing, retention, and deletion. Security concerns protecting confidentiality, integrity, and availability. Candidates should distinguish authentication (who you are), authorization (what you may do), and accounting or audit (what happened). Understand data minimization, purpose limitation, storage limitation, and the difference between pseudonymization and anonymization. Pseudonymized data remains personal data because a key or linkage can re-identify; anonymization requires that re-identification is not reasonably possible. Encryption protects confidentiality but not all metadata, and hashing is not anonymization when inputs are guessable. Know system layers-client, network, application, database, and operations-and that controls must match threats at each layer.
Traps
Questions often equate privacy with security, or assume "encrypted" means "anonymous." Another trap is treating consent as the only lawful basis; privacy principles apply regardless of basis. Watch for "delete the identifier from the main table" as proof of anonymization when a separate mapping table remains. Also, access control is not authentication.
Rule of thumb / worked example
Rule: Follow the identifier. If the system can link a record back to a person-through a key, account ID, device ID, or re-identification dataset-treat it as personal data. Example: replacing names with random IDs in an analytics table while keeping a secure crosswalk table is pseudonymization, not anonymization; apply access control, retention, and deletion to both tables.