Privacy Concepts and Data Rights
Key Takeaways
- Security protects data from unauthorized access; privacy governs purpose, consent, notice, minimization, sharing, retention, and individual rights.
- A controller decides the purpose and means of processing; a processor acts only on the controller's documented instructions — the same firm can be both.
- A data subject is the identifiable person the data describes; data owners, custodians, and stewards have distinct governance roles.
- Core principles include data minimization, purpose limitation, consent/notice, retention limits, de-identification, and data sovereignty.
- The right to be forgotten requires deletion or de-identification unless a legal hold, statutory retention, or active need creates an exception.
Privacy vs Security
Security keeps data confidential, intact, and available. Privacy governs the responsible handling of information about people — it adds questions of purpose, consent, notice, minimization, sharing, retention, deletion, and individual rights. You can have strong security and still violate privacy (for example, securely storing data you had no basis to collect).
Security+ Objective 5.4 names the roles explicitly:
| Role | Meaning | Example |
|---|---|---|
| Data subject | The identifiable person the data is about | A customer whose email and purchase history are stored |
| Controller | Decides why and how personal data is processed | A retailer choosing to use customer data for fulfillment |
| Processor | Processes data on the controller's instructions | A shipping platform that prints labels from addresses |
| Data owner | Accountable business leader for a dataset | The VP who owns the customer database |
| Data custodian / steward | Implements and maintains controls; ensures quality | The DBA enforcing encryption and access rules |
The same company can be a controller in one relationship and a processor in another: a payroll provider is a processor for a client's employee records but a controller for its own staff data. The roles drive obligations: the controller chooses purposes and answers data-subject requests; the processor must act only on instructions, protect the data, and notify the controller of breaches. A clear line separates governance roles from privacy-law roles — a data owner and custodian are internal accountability assignments, while controller, processor, and data subject describe the legal relationship around personal data.
Privacy Principles
| Principle | SY0-701 meaning | Scenario |
|---|---|---|
| Data minimization | Collect only what you need | Do not request birth dates for a newsletter signup |
| Purpose limitation | Use data only for stated purposes | Do not reuse support-chat logs for ads without a basis |
| Consent and notice | Tell people, then collect required permission | Disclose marketing tracking before enabling it |
| Retention | Keep data only as long as justified | Delete dormant trial accounts after the retention period |
| Data sovereignty | Honor where data is stored/processed | Confirm regional hosting commitments in the contract |
Anonymization vs Pseudonymization (frequently confused)
- Anonymization removes identifiers irreversibly — the result generally falls outside personal-data rules because re-identification is not feasible.
- Pseudonymization replaces identifiers with a token (a reversible key held separately) — still personal data because it can be re-linked.
- Tokenization and data masking reduce exposure for specific fields (for example, masking all but the last four digits of a card).
The exam trap: assuming pseudonymized or encrypted data is automatically non-personal. It is not — if it can be reversed or linked, privacy obligations still apply.
Two more roles round out the privacy program. A privacy officer (or Data Protection Officer) owns the privacy strategy, oversees a privacy impact assessment (PIA) for new high-risk processing, and is the contact for regulators and data subjects. A data inventory (the record of what personal data you hold, where it lives, and why) is the prerequisite for almost every privacy task: you cannot honor a deletion request, set a retention period, or assess sovereignty for data you have not mapped.
Security+ expects you to pair a privacy principle with a concrete control — minimization with a tighter intake form, purpose limitation with consent tracking, sovereignty with regional-hosting clauses.
Retention, Deletion, and the Right to Be Forgotten
A fitness app collects names, emails, workout history, device IDs, and optional location. Product wants to keep everything forever for analytics; the privacy team refuses. The final retention schedule keeps account data while active, billing records for the required accounting period, security logs for the approved investigation window, and aggregated usage metrics with no direct identifiers. Optional location history — more sensitive and not core — is deleted after a shorter period.
The right to be forgotten (right to erasure) lets an individual request deletion when continued processing is no longer justified. A defensible workflow:
- Verify the requester is the data subject or an authorized agent.
- Locate the data across production, support tools, analytics, backups, and vendor/processor systems.
- Check exceptions — legal hold, fraud investigation, tax/statutory retention, or active contractual need.
- Delete, anonymize, or restrict the eligible records.
- Record completion evidence without retaining unnecessary personal detail.
Compliance Traps
- Keeping personal data indefinitely because storage is cheap (violates minimization and retention).
- Sharing data with a processor without contract terms for deletion and return.
- Treating pseudonymized or encrypted personal data as non-personal in every case.
- Deleting records that are under legal hold.
- Fulfilling deletion in the main app but forgetting backups, exports, tickets, and vendors.
- Repurposing collected data without checking notice, consent, or legal basis (purpose limitation).
One more concept Security+ ties to privacy is breach notification. When personal data is exposed, both the controller's duty to notify affected data subjects and regulators and the processor's duty to notify the controller are governed by privacy rules and often a contractual clock (commonly framed as "without undue delay" or a fixed window such as 72 hours).
The breach-notification path, the retention schedule, and the right-to-erasure workflow are the three privacy procedures most likely to appear as a scenario, so know that each one must reach beyond the primary application into backups, exports, support tickets, and every processor that received the data — incomplete fulfillment is itself a compliance failure.
A university decides why student records are collected and how they will be used, while a cloud platform stores those records strictly under the university's instructions. What are the likely privacy roles?
A vendor replaces customer names with reversible tokens stored in a separate key vault and claims the resulting dataset is no longer personal data. Why is that claim risky?