Lesson 16: Summarize Data Protection and Compliance Concepts Flashcards
Define ‘regulated data’
Information subject to legal or regulatory requirements regarding their handling, storage, and protection.
What are common forms of regulated data?
Financial information, healthcare records, social security numbers, credit card details, etc.
Define a ‘trade secret’
Intellectual property that gives a company a competitive advantage but hasn’t been registered with a copyright, trademark, or patent.
What do organizations implement to safeguard trade secrets?
NDA’s to bind confidentiality of trade secrets.
Define ‘non-human-readable data’
Binary code, encrypted data, or data represented in a complex structure or encoding that requires specialized software or algorithms to decipher and interpret.
What mechanisms are typically implemented to secure human readable data?
Security monitoring, user awareness, DLP, content filtering, and web security.
What mechanisms are typically implemented to secure non-human readable data?
Encryption, access controls, intrusion detection and prevention, secure data exchange, and code/application security.
Define ‘data classification’
A decision tree for applying one or more tags or labels to each data asset.
Define the ‘public/unclassified’ data classification
No restrictions on viewing the data.
Define ‘Data sovereignty’
The principle that countries and states may impose individual requirements on data collected or stored within their jurisdiction.
Define ‘privacy data’
Personally identifiable or sensitive information associated with an individual’s personal, financial, or social identity, that if exposed or mishandled, could infringe upon an individual’s privacy rights.
What is the purpose of privacy data?
Privacy data focuses on protecting personal information to preserve an individual’s privacy rights, prevent identity theft, and maintain the confidentiality of personal details.
Define a ‘data controller’ in regards to General Data Protection Regulation (GDPR)
The entity or organization that determines the purposes and means of processing personal data.
What is the responsibility of a data controller?
Handling compliance, obtaining appropriate consent from data subjects, providing privacy notices, implementing data protection policies and procedures, and handling data subject requests.
Define a ‘data processor’ in regards to General Data Protection Regulation (GDPR)
Acts under the authority and instructions of the Data Controller to processes personal data.
What is the responsibility of a data processor?
To process personal data only for the purposes defined by the Data Controller; Implement required security measures, maintain CIA of the data, and cooperate with the Data Controller to meet their legal obligations.
What are examples of data processors?
A cloud service provider or a payroll processing company.
Define a ‘data inventory’
List of classified data/information stored or processed by a system.
What is the purpose of a data inventory?
So organizations can ensure that their processing activities align with the specified lawful purposes outlined in privacy laws.
Define ‘data retention’
The process an organization uses to maintain the existence of and control over certain data in order to comply with business policies and/or applicable laws and regulations.
