DataX: Data Security and Privacy

Data Security and Privacy tests whether you can protect data across its lifecycle and let people use it without re-identifying individuals. Expect questions on classification, access control, de-identification strength, and privacy principles such as purpose limitation and minimisation.

Core rules and concepts

• CIA triad: confidentiality, integrity, availability. Encryption serves confidentiality; checksums and access controls protect integrity; backups and redundancy protect availability.
• Classification drives handling: public, internal, confidential, restricted (labels vary). The label decides who may access, whether masking or encryption is required, retention, and whether data can leave the environment.
• Access control: RBAC assigns permissions to roles; ABAC evaluates attributes such as department, purpose, location and sensitivity; row-level and column-level security give finer granularity. Least privilege, need-to-know, segregation of duties and periodic recertification are the operating rules.
• Protection techniques: encryption at rest and in transit with managed keys (rotation, separation of duties); masking (static for non-production, dynamic at query time); tokenisation (vault-based, format-preserving); pseudonymisation (keyed mapping - reversible, so still personal data); anonymisation (irreversible in principle).
• Statistical disclosure control: k-anonymity (each record indistinguishable from at least k−1 others on quasi-identifiers); l-diversity and differential privacy address attribute disclosure and inference that k-anonymity alone permits.
• Privacy principles (GDPR Art. 5, PIPL and equivalents): lawfulness, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, accountability - plus data-subject rights such as access, rectification, erasure and portability.

Worked example

A hospital releases visit data for research. Direct identifiers are removed; age is generalised to five-year bands, postcode reduced to two characters, rare diagnoses grouped. The team confirms every combination of quasi-identifiers covers at least five records (k = 5), documents residual re-identification risk, and requires a data use agreement banning re-identification attempts. Replacing names with hashed IDs alone would not suffice: hashed phone numbers are trivially brute-forced.

Traps

Calling pseudonymised data anonymous; unsalted hashing of low-entropy identifiers; masking a dashboard while raw exports stay open; collecting data "just in case" (minimisation breach); forgetting backups, logs and test environments; granting schema-wide read access because row-level security is inconvenient.