12.4 Data Privacy, Sovereignty, Sharing & Retention Guardrails

12.4 Data Privacy, Sovereignty, Sharing & Retention Guardrails

Security controls answer who can access a resource. Privacy and governance also ask why, for how long, in what form, and in which jurisdiction the data may be used.

Masking, pseudonymization, and anonymization

Dynamic masking changes what a query returns according to the caller while the stored value remains available to authorized users. Static masking creates a transformed copy for testing or analytics. Tokenization replaces a value with a token and stores or derives a protected mapping. Pseudonymization separates identity from data but may be reversible with additional protected information.

Anonymization aims to make re-identification impracticable. Removing a name is not sufficient when location, age, and timestamps can identify a person in combination. Generalization, suppression, aggregation, noise, and k-anonymity-style analysis can reduce re-identification risk, but the appropriate test comes from the governing policy or law.

Mask as early as the approved use permits. Preserve raw sensitive data only in a restricted zone, record the transformation version, and prevent masked copies from being joined with a lookup that reverses the protection. Encryption protects data from unauthorized access; it does not anonymize data for an authorized decrypting user.

Data sovereignty and residency

Residency usually concerns where data is stored or processed. Sovereignty is broader: data is subject to the laws and governance of a jurisdiction. Translate the requirement into an explicit Region allowlist for each data class.

Inventory every copy:

• primary S3 objects and database storage;
• cross-Region replicas and global tables;
• snapshots, AWS Backup copies, and exports;
• CloudWatch and CloudTrail logs;
• Athena results, Glue temporary directories, and spill files;
• model inputs, vector indexes, caches, and support artifacts.

A pipeline can keep its primary bucket in an allowed Region while violating policy through a backup vault or query-results bucket elsewhere.

Use organization controls and preventive IAM conditions where supported to deny disallowed Region operations. Configure service-specific replication only to approved destinations. AWS Config can detect configuration drift, and CloudTrail can provide evidence of API changes. Preventive controls are stronger than discovering an illegal copy after it is created.

Region-aware backup and replication

Backup policies should select approved destination vaults and KMS keys. S3 replication rules, Aurora Global Database, DynamoDB global tables, and Redshift snapshot copy all create additional jurisdictional copies. Disable or omit destinations that policy forbids, and test recovery inside the allowed boundary.

Deletion also has multiple layers. Expiring a catalog entry does not delete S3 versions, Iceberg snapshots, backup recovery points, or replicated objects. Define the system of record and a deletion workflow that reaches derivatives while respecting legal holds and immutable retention.

Governed data sharing

Redshift data sharing lets a producer share live database objects with consumers without unloading and copying the data. The producer controls the datashare and objects; consumers create databases that reference the share. This reduces duplicate pipelines but does not remove governance. Grant the least set of schemas, tables, views, or functions, and understand whether writes or cross-Region access are supported for the chosen sharing mode.

Lake Formation and SageMaker Catalog subscriptions govern lake assets through grants to execution roles. AWS Data Exchange can support provider-consumer distribution use cases. In every pattern, define:

1. data owner and approved purpose;
2. consumer principal or project;
3. object and row or column scope;
4. duration and review date;
5. revocation and downstream-deletion procedure;
6. audit evidence.

Sharing metadata without data-plane permission produces a broken subscription. Granting broad S3 access beneath a filtered view can bypass the intended control.

Governance framework

A governance program is an operating model, not one AWS service. Typical roles include data owner, steward, custodian or platform team, producer, consumer, and security or privacy reviewer.

For each data product, define classification, business meaning, schema contract, quality SLO, freshness, lineage, access policy, retention, residency, and incident contact. Automate evidence: catalog ownership, quality results, access reviews, Config state, CloudTrail events, Macie findings, and deletion logs.

Use exception workflows with an owner and expiration date. A permanent undocumented exception is policy drift. Review high-risk shares and cross-Region configurations regularly, and make consumer access fail closed when approval expires.

Scenario method

When the exam mentions compliance, do not guess a particular statute. Extract the stated requirement: obscure a column, prevent a Region copy, identify PII, share without duplication, or prove a configuration history. Then select the control that directly enforces that requirement and produces evidence.