Data Security and Privacy
What this domain tests
Can you turn classification and privacy obligations into engineering decisions: what data, whose purpose, which control? Scenarios test access models, masking choices, retention and data subject rights.
Core rules
- CIA triad: confidentiality, integrity, availability. Security controls protect data; privacy controls limit purpose, collection and retention.
- Classify first (public, internal, confidential, restricted), label, then apply controls by class. Classification with no enforcement is paperwork.
- Access: authenticate identity, then authorize. RBAC grants by role; ABAC adds attributes such as region, clearance or purpose for row-level control. Apply least privilege and periodic recertification.
- Protection: encryption in transit (TLS) and at rest (AES-256), tokenization (format-preserving substitutes), masking (irreversible display obfuscation) and pseudonymization (reversible with a key). Only anonymization removes data from privacy scope, and re-identification risk must be assessed.
- Privacy principles: lawful basis, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability. Document with records of processing and a DPIA for high-risk processing.
- Data subject rights: access, rectification, erasure, restriction, portability, objection. Erasure must reach backups, archives, derived tables and third parties.
- Breach notification: assess and notify the regulator within 72 hours where the regime requires it.
Worked example
Marketing wants a full production customer extract in a cloud sandbox for model training. Reasoning: (1) Purpose and lawful basis first; confirm training is compatible with the original collection purpose. (2) Minimize to the columns the model needs, dropping name, address and free text. (3) Replace direct identifiers with tokens and hold the mapping in a controlled vault. (4) Restrict access to the named team, log queries, set an expiry date and delete at end of purpose. (5) If re-identification is plausible, treat the data as personal and keep the DPIA current. The answer is not simply encrypt the file; it is minimize, pseudonymize, restrict, expire.
Traps that cost marks
- Calling pseudonymized data anonymous.
- Encrypting data but storing keys alongside it.
- Using RBAC where row-level or purpose-based access is required.
- Retaining data indefinitely in case it becomes useful.
- Deleting from the primary store but not backups, caches or derived tables.