Data Protection and Privacy

Data protection is the process of safeguarding important information from corruption, compromise, or unauthorized access. Privacy is the right of individuals to control how their personal information gets collected, used, and shared. Both concepts work together — protecting data means protecting the people behind that data.

Every organization that collects, processes, or stores personal data has both an ethical responsibility and, in most countries, a legal obligation to protect that data.

Types of Data That Need Protection

Data States: Where Data Needs Protection

Data exists in three states. Each state requires specific protection strategies.

THREE STATES OF DATA:

┌─────────────────────────────────────────────────────────┐
│                    DATA STATES                          │
│                                                         │
│  DATA AT REST          DATA IN TRANSIT    DATA IN USE   │
│  Stored on disk,       Moving across      Being actively│
│  in database,          network, email,    processed in  │
│  on backup tape        internet           memory/CPU    │
│                                                         │
│  Protection:           Protection:        Protection:   │
│  Encryption at rest    TLS/HTTPS          Memory        │
│  Access control        VPN                encryption    │
│  Physical security     Encrypted email    Secure coding │
└─────────────────────────────────────────────────────────┘

Data Classification

Data classification assigns a sensitivity level to data based on its importance and the impact of unauthorized disclosure. Classification helps organizations apply the right level of protection to the right data — no more, no less.

STANDARD DATA CLASSIFICATION LEVELS:

┌────────────────┬───────────────────────────────────────────────┐
│ Level          │ Description + Example                         │
├────────────────┼───────────────────────────────────────────────┤
│ PUBLIC         │ Anyone can see it. Company website content,   │
│                │ published annual reports.                     │
├────────────────┼───────────────────────────────────────────────┤
│ INTERNAL       │ For employees only. Internal memos,           │
│                │ org charts, internal procedures.              │
├────────────────┼───────────────────────────────────────────────┤
│ CONFIDENTIAL   │ Restricted to specific teams.                 │
│                │ Customer data, salary information, contracts. │
├────────────────┼───────────────────────────────────────────────┤
│ RESTRICTED /   │ Highest sensitivity. Disclosure causes major  │
│ TOP SECRET     │ harm. Encryption keys, M&A plans, source code.│
└────────────────┴───────────────────────────────────────────────┘

RULE: Apply protection level matching the data's classification.
      Do not over-protect public data (wastes resources).
      Never under-protect restricted data (creates risk).

Encryption for Data Protection

Encryption is the primary technical control for data protection. Data at rest must be encrypted on disk so that physical theft of a device does not expose its contents. Data in transit must be encrypted over HTTPS, VPN, or encrypted email to prevent interception.

ENCRYPTION IN PRACTICE:

Laptop Stolen (Without Encryption):
  Thief removes hard drive → connects to another computer
  → All files readable immediately → complete data breach

Laptop Stolen (With Full Disk Encryption - BitLocker/FileVault):
  Thief removes hard drive → connects to another computer
  → All files appear as random unreadable characters
  → Without the encryption key → zero data exposed

LESSON: Full disk encryption converts a theft incident into a "lost hardware" incident
        with no data breach, because the data itself is useless without the key.

Data Backup and Recovery

Backups protect data availability. If data gets destroyed — by ransomware, hardware failure, or accidental deletion — backups allow recovery. A backup with no recovery plan is incomplete. The ability to restore from backup must be tested regularly.

The 3-2-1 Backup Rule

3-2-1 BACKUP STRATEGY:

3 = Keep 3 copies of data (1 original + 2 backups)
2 = Store on 2 different types of media (e.g., hard drive + cloud)
1 = Keep 1 copy offsite (different physical location)

EXAMPLE:
  Original data: Company server (on-premises)
  Backup 1: External hard drive (in office safe)
  Backup 2: Cloud storage (AWS S3, Azure Blob, etc.)

SCENARIO: Ransomware encrypts the server AND the external drive
  → Cloud backup is offsite and unaffected
  → Restore from cloud → business continues

Data Minimization

Data minimization is the principle of collecting only the data that is strictly necessary for a specific purpose. Data that is not collected cannot be stolen. Organizations that collect less data have smaller attack surfaces and lower legal liability in case of a breach.

DATA MINIMIZATION IN PRACTICE:

WRONG APPROACH (Over-collection):
  A local pizza delivery app collects:
  → Full name, address, phone, email (needed for delivery)
  → Date of birth, national ID, income range (NOT needed)
  → The unnecessary data increases breach risk with no benefit

RIGHT APPROACH (Minimization):
  The app collects ONLY:
  → Name, delivery address, phone, email, payment info
  → Nothing else collected, nothing else at risk

Data Retention and Disposal

Data that is kept longer than necessary creates ongoing risk. A clear data retention policy defines how long each type of data is stored and what happens to it afterward. When data reaches the end of its retention period, it must be securely deleted.

SECURE DATA DISPOSAL METHODS:

DIGITAL DATA:
  Simple Delete = NOT secure (file still recoverable)
  Overwriting = Write random data over the file multiple times (secure)
  Cryptographic Erasure = Destroy the encryption key (data unreadable even if bits remain)

PHYSICAL MEDIA:
  Hard Drive: Degaussing (strong magnetic field) or physical shredding
  Paper Documents: Cross-cut shredding (not just straight-cut)
  USB Drives: Physical destruction

DANGER OF IMPROPER DISPOSAL:
  Old office printer donated without wiping internal storage
  → New owner extracts stored scanned documents containing HR and financial data

Privacy Regulations Around the World

Many countries and regions have enacted laws requiring organizations to protect personal data and respect individual privacy rights. Non-compliance results in significant fines and reputational damage.

Privacy by Design

Privacy by Design is an approach where privacy protection is built into systems from the very beginning — not added as an afterthought. The seven principles of Privacy by Design include: proactive prevention, privacy as the default, embedding privacy into system design, full functionality without compromising privacy, end-to-end security throughout data lifecycle, visibility and transparency, and respect for user privacy.

PRIVACY BY DESIGN VS. PRIVACY AS AN AFTERTHOUGHT:

AFTERTHOUGHT APPROACH:
  Build app → collect all data → launch → get complaints about privacy
  → Add a privacy policy page → compliance team patches issues reactively

PRIVACY BY DESIGN:
  Before building: Define what data is needed and why
  During build: Encrypt data, minimize collection, build consent flows
  At launch: Privacy is already embedded, not bolted on
  Result: Fewer breaches, lower compliance cost, user trust

Data protection covers the technical and organizational measures to keep data safe. When those measures fail — despite all precautions — an incident occurs. The next topic covers how to detect, respond to, and recover from security incidents in a structured and effective way.