What it means
Privacy and security overlap but are not interchangeable. Security can protect personal information against breaches, yet a perfectly secured system can still use data unfairly, excessively, opaquely, or beyond the purpose people expected. Privacy asks whether processing is appropriate, lawful, transparent, limited, and respectful of individual rights.
How it works
Effective programs coordinate data inventories, classification, access controls, retention, consent or other processing authority, notices, rights requests, incident response, vendor oversight, and privacy engineering. The privacy risk to individuals and the cybersecurity risk to organizations should both inform design decisions.
A mobile application encrypts precise location data and restricts access, satisfying important security goals. Privacy concerns remain if it collects location continuously without necessity, retains it indefinitely, or shares it for an unrelated purpose.
Practical focus
- Define purpose and minimize personal-data collection
- Apply security controls throughout the data lifecycle
- Assess impacts on individuals as well as organizational loss
- Coordinate privacy, legal, product, engineering, and security decisions
Common mistakes
- Assuming encryption resolves every privacy concern
- Treating public information as free of privacy risk
- Keeping personal data simply because storage is inexpensive
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: