Privacy Engineering, Operations and Incident Management
Privacy engineering turns obligations into controls; operations keeps them working. Incident questions test whether you can separate a security event from a reportable personal data breach and act in the right order.
Engineering controls
- Data mapping and classification drive every other control.
- Minimise collection; prefer aggregates, pseudonyms or synthetic data in test environments.
- PETs: encryption, tokenisation, masking, k-anonymity, differential privacy, secure multiparty computation; each trades utility against re-identification risk.
- Consent management platforms record purpose, scope and withdrawal; DSR automation finds and deletes data across systems, including backups and SaaS.
- Retention jobs, access reviews, logging and DLP detect drift.
Incident response
Prepare (plan, roles, tabletop, contact lists); detect; triage and assess personal-data impact; contain; eradicate and recover; notify; review. A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to personal data. DPDP requires intimation to the Board and affected Data Principals in the prescribed form and manner; GDPR sets 72 hours to the supervisory authority where risk is likely. Document every incident, including those not notified.
Worked example
A cloud bucket holding 40,000 customer records - names, phone numbers, masked card tokens - is public for ten days.
- Contain: close public access, rotate keys, preserve logs; do not delete evidence.
- Assess: categories, volume, duration, re-identification risk (masked tokens lower it), likely harm.
- Notify: if risk is high, inform the Board and individuals; the processor must notify the controller without delay.
- Remediate: configuration-as-code checks, access review, monitoring alert.
- Review: update the DPIA and tabletop.
Traps
- Deleting logs during containment.
- Over-notifying every security event or under-notifying to protect reputation.
- Forgetting the processor's contractual notification duty.
- Assuming encryption removes all notification duties.