Data Security, Privacy, and Compliance: Controls, Classification, and Law
What to master
Security and privacy questions test control design and regulatory mapping. Know the CIA triad and how controls map to it. Understand data classification (public, internal, confidential, restricted) and how classification drives handling. Study access control models (RBAC, ABAC), least privilege, encryption at rest and in transit, tokenization versus masking versus pseudonymization, and key management. Privacy concepts include PII, data minimization, purpose limitation, consent, retention, right to erasure, and cross-border transfer constraints. Map major regimes at a high level-GDPR (EU), CCPA/CPRA (California), HIPAA (health), PCI DSS (payments)-without over-claiming specifics you cannot verify.
Traps in questions
- Treating pseudonymization as anonymization; re-identification risk remains.
- Assuming masking protects data at rest if the warehouse still stores raw values.
- Applying one regulation globally without checking jurisdiction and data subject location.
- Forgetting that retention limits and erasure rights affect backup and archive design.
Worked example
An analyst needs customer emails for a campaign. Rather than granting table access, apply dynamic masking so emails are visible only to the campaign role, and log access. This satisfies least privilege and purpose limitation while preserving auditability.
Rule of thumb: classify first, then choose the control-classification drives encryption, masking, retention, and access decisions.