Data Security and Privacy
Data Security and Privacy tests controls that protect data and controls that limit its use lawfully. Questions pair a data classification with a control set such as masking, encryption, or access models, and check whether you can distinguish anonymization from pseudonymization and prevention from detection.
Core rules and concepts
- CIA triad: confidentiality, integrity, availability. Security controls are preventive, detective, or corrective; choose per risk rather than defaulting to encryption.
- Classify first: public, internal, confidential, restricted. Classification drives handling, retention, access, and masking rules; without it, controls are arbitrary.
- Access models: role-based (RBAC) is coarse and auditable; attribute-based (ABAC) uses purpose, location, and sensitivity; least privilege and separation of duties apply to both.
- Encryption protects data at rest and in transit, but not against an authorized user misusing their access; keys must be managed separately from the data.
- Masking, tokenization, and pseudonymization reduce exposure while preserving referential integrity and some analytics utility. Hashing low-entropy fields such as dates of birth or postcodes is reversible by brute force and is not anonymization.
- Privacy principles: purpose limitation, minimization, accuracy, storage limitation, consent or another lawful basis, subject access requests, breach notification, privacy by design.
Worked example
An analytics team needs customer-level data for churn modeling but must not see names, emails, or full addresses. Reasoning: the purpose is analytics, not contact, so apply minimization. Replace direct identifiers with a stable surrogate token that preserves joins across tables, mask name and email to null, generalize address to postcode district, keep dates but truncate to month where day precision is unnecessary. Grant access to a restricted schema via an ABAC policy that requires the analytics role and an approved purpose. Log queries and review monthly. Pseudonymized data remains personal data, so retention and subject-access handling still apply.
Traps that cost marks
- Calling pseudonymized or hashed data anonymous and dropping privacy obligations.
- Relying on encryption alone while over-privileged accounts persist.
- Applying controls before classification, so effort goes to the wrong data.
- Treating consent as the only lawful basis in every jurisdiction.
- Ignoring retention and deletion, which are where audits usually fail.