Data Quality, Privacy, and Security
What this domain tests
This domain tests data fitness, privacy, and security across collection, training, and operation. Questions often combine legal concepts with technical failure modes.
Core rules
- Data quality is fitness for purpose: relevance, representativeness, completeness, accuracy, timeliness, consistency, and label quality.
- Privacy requires lawful basis, purpose limitation, minimization, retention limits, and rights handling. Pseudonymization reduces identifiability but is not anonymization.
- Security preserves confidentiality, integrity, and availability. Controls include access control, encryption, segmentation, logging, vendor assurance, and incident response.
- ML-specific threats include data poisoning, backdoors, membership inference, model extraction, and adversarial inputs.
- Point-in-time data prevents look-ahead bias; lineage supports reproducibility and challenge.
Worked example
A fraud model uses three years of transactions. Labels come from chargebacks that arrive up to 90 days later. Using the final label as if known at authorization time leaks future information and inflates performance. The fix is point-in-time feature and label construction, retention of raw data for audit, and separate treatment of delayed labels in monitoring.
Traps
Equating anonymization with pseudonymization; assuming privacy compliance proves security; ignoring feedback loops where model actions change future training data; and using post-outcome fields as features.