II: Fundamentals of Privacy-related IT

Question 1

Privacy Notice

Answer 1

A notice to users that explains how data is collected, used, retained and disclosed

Question 2

Privacy Policy

Answer 2

An internal document meant to communicate the organization’s privacy best practices.

Question 3

Security Policy

Answer 3

Use access controls to prevent unauthorized access to company data. Also establishes a policy on physical security from both internal and external threats.

Less about preventing excessive data collection and more about preventing unauthorized access to data.

Question 4

Data classification policies (security policy)

Answer 4

Policies for granting and revoking access to assets.

Question 5

Data schema (security policy)

Answer 5

Used to separate customer information (e.g. separating personal information from purchase data), helping to ensure a compromised system doesn’t expose everything.

Question 6

Data retention (security policy)

Answer 6

Policy for retention and eventual removal of data.

Question 7

Data deletion (security policy)

Answer 7

Remove data when it’s no longer needed.

Question 8

Contracts and agreements

Answer 8

Agreements with third-party vendors regarding data storage (e.g. GCP).

Question 9

COBIT

Answer 9

Business and IT goals are linked and measured to create responsibilities of business and IT teams.

Meant to ensure companies follow the law, become more agile and earn more.

Question 10

ITIL

Answer 10

Framework for aligning IT services with the needs of the business.

Describes processes, procedures, tasks and checklists that are neither organization-specific nor technology-specific.

Question 11

Data inventories

Answer 11

An inventory of data meant to help protect privacy. Requires knowing:

• how data is collected
• how data is processed
• where data is stored
• how data is classified

Question 12

Enterprise Architecture

Answer 12

The overall organizational design of a system

Question 13

Privacy Impact Assessment

Answer 13

Process to assist organizations in identifying and managing privacy risks that arise from new projects, initiatives, systems, etc.

Question 14

Incident Responses

Answer 14

Response to data breach. Some incidents are security incidents, some are privacy incidents, and some are both. Examples include:

• DoS
• Malware Infection
• Hacking attempts
• Data exfiltration
• Lost Devices
• Misdirected emails

Some breaches expose proprietary business data, rather than personal data.

Question 15

Security and Privacy in the System Development Life Cycle

Answer 15

1. Securely Provision
2. Operate and Maintain
3. Protect and defend
4. Investigate