Privacy and Data Protection Foundations
The Foundations domain tests the vocabulary every later domain depends on: what counts as personal data, who decides why it is processed, and how privacy differs from security and confidentiality. Items are usually definition matching, role identification in a short scenario, and "which principle or framework applies" questions. Precision in terminology is the whole game.
Core concepts
- Personal data is any information relating to an identified or identifiable natural person. Identifiability is relative: GDPR Recital 26 asks whether identification is reasonably likely using all means reasonably likely to be used, considering cost and time.
- Pseudonymisation replaces identifiers with keys; the data remains personal because re-identification is possible. Anonymisation is irreversible in context and falls outside privacy law.
- Sensitive / special category data (health, biometrics used for unique identification, genetic data, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation) attracts stricter conditions.
- Roles: the controller determines purposes and means; the processor acts on the controller's documented instructions. CCPA/CPRA equivalents are business, service provider and contractor.
- FIPPs (OECD, 1980) - collection limitation, purpose specification, use limitation, data quality, security safeguards, openness, individual participation, accountability - underpin most modern statutes.
- Privacy by Design (Cavoukian) has seven principles, including proactive rather than reactive, privacy as the default, and full functionality.
Worked example
A retailer replaces customer email addresses with random tokens and stores the mapping key in a separate, access-controlled table. A colleague calls the dataset "anonymous, so GDPR does not apply." That is wrong. The dataset is pseudonymised: the retailer can re-link records using the key, so individuals remain identifiable and the data stays personal. Only if the key were destroyed and re-identification were not reasonably likely would the data plausibly become anonymous.
Traps that cost marks
- Treating encryption or hashing as anonymisation.
- Assuming "PII" and "personal data" are interchangeable legal terms; definitions differ by jurisdiction.
- Confusing controller/processor with data owner/custodian, or assuming processors have no independent duties - GDPR Articles 28 and 32 apply directly to them.
- Forgetting that privacy is broader than security: security protects confidentiality, integrity and availability; privacy also governs purpose, fairness and individual control.