8.2 Privacy & Compliance
Privacy is the right of a person to control what happens to information about them. In the enterprise, privacy is enforced through policy, process, and engineering controls. This lesson maps the data lifecycle and the questions an engineer must answer at each stage.
The Data Lifecycle
Figure 5.8 - Each stage carries its own privacy obligation.
Engineer Questions Per Stage
| Stage | Question To Answer |
|---|---|
| Collect | Is consent recorded with timestamp and version? Is there a lawful basis if not consent? |
| Store | Is data encrypted at rest? Where is the canonical store? |
| Use | Is the access purpose-bound and logged? |
| Share | Is there a Data Sharing Agreement with the recipient? |
| Retain | What is the retention period and who reviews it? |
| Dispose | Is deletion cryptographic or just logical? Does it cascade to backups? |
Privacy By Design Principles
- Proactive, not reactive.
- Privacy as the default.
- Privacy embedded into design.
- Full functionality (no false trade-off).
- End-to-end security.
- Visibility and transparency.
- Respect for user privacy.
Discussion
Loading…