Data Security and Privacy

Introduction

Data is one of an organisation’s most valuable assets. It supports decision-making, customer service, scientific research, financial transactions and public administration. At the same time, data can create serious harm when it is disclosed, altered, destroyed or used without legitimate authority. Data security protects information from unauthorised access, modification, loss and disruption. Privacy focuses on the lawful, fair and respectful collection and use of information about identifiable individuals.

Although related, security and privacy are not identical. A database may be technically secure yet used for an unfair purpose. Conversely, an organisation may have a legitimate purpose but fail to protect the data adequately. Effective governance therefore combines information security controls, privacy principles, organisational accountability and legal compliance.

This chapter presents a lifecycle-based approach to data protection. It explains data classification, access control, encryption, tokenization, masking, backup, data-loss prevention, privacy principles, consent, retention, breach obligations and privacy-enhancing technologies.

Learning Objectives

By the end of this chapter, students should be able to:

1. Classify data according to sensitivity, business value and potential harm.
2. Explain how security controls apply throughout the data lifecycle.
3. Compare access control, encryption, tokenization and masking.
4. Design suitable backup and data-loss prevention strategies.
5. Apply privacy principles concerning purpose, consent, minimisation, retention and individual rights.
6. Analyse a data-breach scenario and recommend technical and governance responses.
7. Evaluate privacy-enhancing technologies and their limitations.

1. Data as an Information Asset

Data exists in many forms: structured database records, documents, source code, images, logs, messages, sensor readings and backups. It may be stored on local devices, cloud platforms, removable media or third-party systems. Its risk depends not only on content but also on context.

Personal data is information relating to an identified or identifiable person. Examples include a name, identification number, location record, online identifier or combined attributes that allow identification. Sensitive personal data may include health, biometric, financial, genetic or other specially protected information, depending on applicable law.

The traditional security objectives are:

• Confidentiality: information is available only to authorised subjects.
• Integrity: information remains accurate, complete and protected from unauthorised alteration.
• Availability: authorised users can access information when required.

Privacy adds questions such as: Was the information collected fairly? Was the person informed? Is the use compatible with the stated purpose? Is the amount collected necessary? How long should it be retained?

A useful distinction is between a data owner, who determines business purpose and acceptable use; a data custodian, who operates systems and safeguards; a data processor, who handles data on behalf of another organisation; and a data subject, whom personal data describes. A single organisation may perform several of these roles, but the responsibilities should remain clear.

2. Data Classification and Handling

Classification is the process of assigning a sensitivity level to data and defining the controls required for each level. A classification scheme should be understandable, consistently applied and linked to operational actions.

Classification should consider confidentiality, integrity, availability, legal obligations, contractual duties and potential impact. A public document can still require integrity protection, while a confidential system may require high availability even if its contents are not personal.

Handling rules

A classification policy should specify:

• who may access the data;
• whether external sharing is permitted;
• approved storage and transmission methods;
• encryption requirements;
• retention and secure disposal periods;
• logging and monitoring expectations;
• incident-reporting procedures.

Classification is not a one-time label. Data may become less sensitive after publication, or more sensitive when combined with other datasets. Periodic review and automated discovery tools can identify unclassified or incorrectly classified information.

3. The Data Lifecycle

Data security should be applied from creation to disposal. A practical lifecycle contains the following stages:

1. Creation or collection: determine purpose, accuracy requirements and lawful basis.
2. Processing and use: restrict access and record significant activity.
3. Storage: protect databases, files, endpoints and backups.
4. Sharing and transmission: verify recipients and secure communication channels.
5. Archiving: preserve information only when a legitimate requirement exists.
6. Disposal: securely delete, destroy or anonymise data when no longer needed.

Figure: Security and privacy controls operate throughout the data lifecycle rather than only at storage.

Controls must follow the data. For example, encrypting a production database does not protect an unencrypted export copied to a laptop. Lifecycle governance should therefore include inventories, data-flow maps, approved processing activities and ownership assignments.

4. Access Control

Access control determines who or what may perform which action on a resource. The basic elements are a subject such as a user or service, an object such as a file or database row, an action such as read or delete, and a policy decision allowing or denying the action.

The principal rules are:

• Least privilege: grant only the permissions required for an approved task.
• Need to know: restrict access to information necessary for a role or decision.
• Separation of duties: divide sensitive activities among multiple people or roles.
• Default deny: deny access unless a policy explicitly permits it.
• Accountability: associate actions with identifiable accounts and reliable logs.

Authentication establishes identity; authorisation determines permissions; accounting records activity. Strong authentication, especially multi-factor authentication, reduces the risk of stolen passwords but does not replace authorisation review.

Common models include:

• Discretionary access control (DAC): resource owners may grant permissions.
• Mandatory access control (MAC): centrally defined labels and clearance rules control access.
• Role-based access control (RBAC): permissions are assigned to job roles.
• Attribute-based access control (ABAC): decisions use attributes such as user role, device health, location, time and data sensitivity.

RBAC is manageable in stable organisations, while ABAC can express more contextual policies. Both can fail if roles or attributes are inaccurate. Joiner–mover–leaver processes, periodic access reviews, privileged-access management and immediate account revocation are essential operational controls.

5. Encryption, Tokenization and Masking

Encryption

Encryption transforms plaintext into ciphertext using an algorithm and a key. Decryption reverses the transformation for an authorised party. Symmetric encryption uses one shared secret key and is efficient for large data volumes. Asymmetric cryptography uses a public and private key pair and is useful for key exchange, digital signatures and identity mechanisms, although it is generally less efficient for bulk encryption.

Encryption may protect:

• Data at rest: disks, databases, files and backups.
• Data in transit: network communications, application interfaces and administrative sessions.
• Data in use: memory or computation environments, using specialised techniques such as confidential computing.

Encryption does not solve every problem. If an attacker obtains the key, plaintext may be exposed. Key management therefore requires generation, storage, rotation, access restriction, backup, revocation and secure destruction. Passwords should not be encrypted for later recovery; they should be protected with a slow, salted password-hashing function designed for that purpose.

Integrity and authenticity often require authenticated encryption or a separate message authentication mechanism. A digital signature provides evidence that a private key holder signed data and that the signed content has not changed; encryption alone does not provide this guarantee.

Tokenization

Tokenization replaces a sensitive value with a surrogate token. The original value is retained in a protected token vault or represented through a controlled mapping. A payment application, for example, may use a token instead of storing a card number in every system. Tokenization reduces the number of systems handling the original value, but the vault and tokenisation service remain highly sensitive.

Masking

Masking obscures some or all of a value. Static masking creates a non-sensitive copy for testing; dynamic masking displays different portions according to the viewer’s permissions. Masking is useful for screens, reports and development environments, but it may be reversible or insufficient if too much information remains visible.

A hash is not automatically anonymous. Low-entropy values can be guessed, and combinations of supposedly anonymous attributes can re-identify people.

6. Backup, Recovery and Availability

Backups are independent copies used to restore data after accidental deletion, ransomware, hardware failure or disaster. A sound backup strategy addresses confidentiality and integrity as well as availability.

Two important planning measures are:

• Recovery point objective (RPO): the maximum acceptable amount of data loss measured in time. An RPO of four hours means the organisation aims to lose no more than four hours of updates.
• Recovery time objective (RTO): the target time within which a service or dataset should be restored.

The commonly used 3-2-1 approach recommends at least three copies, on two different media or platforms, with at least one copy offline or otherwise isolated. Backups should be encrypted, access-controlled, monitored and tested. Immutable or write-once storage can reduce ransomware risk, but it must be combined with protected credentials and recovery procedures.

A backup is not proven by its existence. Restoration tests should verify that applications, permissions, keys, dependencies and data integrity can be recovered. Retention schedules should distinguish operational backups from legally required archives; indefinite accumulation increases privacy and breach exposure.

7. Data-Loss Prevention

Data-loss prevention (DLP) identifies and controls sensitive information leaving approved locations or being used in prohibited ways. DLP may operate at endpoints, email gateways, web proxies, cloud applications, databases and network boundaries.

A DLP programme typically includes:

1. Discovery: locate sensitive data and identify patterns such as identity numbers.
2. Classification: associate data with sensitivity and handling rules.
3. Policy definition: specify permitted destinations, users and channels.
4. Detection: inspect content, context and user behaviour.
5. Response: warn, block, quarantine, encrypt or alert investigators.
6. Tuning: reduce false positives and review policy effectiveness.

Exact pattern matching, regular expressions, document fingerprints and machine-learning classifiers may support detection. However, encryption, compression, screenshots, handwritten content and novel formats can reduce visibility. Excessive blocking may cause users to bypass controls, while excessive monitoring may create new privacy concerns. DLP must therefore be risk-based, transparent where appropriate and subject to access restrictions itself.

8. Privacy Principles and Lawful Processing

Privacy frameworks differ across jurisdictions, but many express similar principles:

• Lawfulness, fairness and transparency: processing should have a legitimate basis and be understandable to affected people.
• Purpose limitation: collect and use data for specified, legitimate purposes rather than indefinite future use.
• Data minimisation: collect only what is reasonably necessary.
• Accuracy: provide methods to correct inaccurate information.
• Storage limitation: retain data no longer than justified.
• Integrity and confidentiality: apply proportionate safeguards.
• Accountability: be able to demonstrate compliance through policies, records, assessments and evidence.

A privacy notice should explain what is collected, why it is collected, how it is used, who receives it, how long it is retained and what rights are available. Notices should be clear rather than hidden in unnecessarily complex language.

Consent and other lawful bases

Consent is meaningful only when it is informed, specific, freely given and expressed through a clear affirmative action. Silence, preselected options or coercive conditions are weak evidence of valid consent. Consent should be recorded and withdrawal should be practical. However, consent is not always the only lawful basis; contracts, legal obligations, vital interests and legitimate interests may be relevant under particular legal regimes. Organisations must not treat consent as a universal substitute for analysis.

Individual rights

Depending on applicable law, individuals may have rights to access, correction, deletion, restriction, portability, objection or review of automated decisions. These rights require identity verification, defined response procedures, exception handling and secure communication. Rights may be limited by legal obligations, freedom of expression, public interest or the rights of others.

Privacy by design and default

Privacy should be incorporated during requirements analysis and system design, not added after deployment. Privacy-friendly defaults may include collecting fewer fields, restricting visibility, using short retention periods, separating identifiers from content and requiring explicit action before optional sharing. A privacy impact assessment is useful when processing is large-scale, sensitive, systematic or likely to create significant risks.

9. Retention, Disposal and Breach Obligations

Retention should be based on business need, legal requirements, contractual duties and the rights of individuals. A retention schedule maps data categories to owners, periods, archival conditions and disposal methods. Legal holds may suspend ordinary deletion when litigation or investigation is pending.

Secure disposal depends on the medium. It may involve cryptographic erasure, secure overwriting where appropriate, physical destruction or verified deletion from cloud services. Simply moving a file to a recycle bin is not secure disposal. Copies in caches, exports, logs and backups must be considered.

A personal-data breach can involve unauthorised disclosure, access, alteration, loss or destruction. A defensible response normally includes:

1. detecting and containing the event;
2. preserving evidence and establishing facts;
3. assessing affected data, people and likely harm;
4. notifying regulators, customers or other parties when required and within applicable deadlines;
5. resetting credentials, correcting vulnerabilities and monitoring for further harm;
6. documenting decisions and conducting a lessons-learned review.

Notification obligations vary by jurisdiction, sector and severity. Organisations should not wait for perfect certainty before escalating a credible incident internally. A breach plan should define roles for security, privacy, legal, communications, management and relevant service providers.

10. Privacy-Enhancing Technologies

Privacy-enhancing technologies (PETs) reduce unnecessary exposure while enabling legitimate analysis or service delivery. Important examples include:

• Pseudonymization: replacing direct identifiers with codes while retaining a possibility of re-linking under controlled conditions.
• Anonymization: altering data so that individuals are not reasonably identifiable, recognising that absolute irreversibility is difficult to guarantee.
• Aggregation: reporting groups or totals rather than individual records.
• Differential privacy: adding carefully calibrated randomness so that the presence or absence of one person has limited effect on published results.
• Federated learning or analysis: moving models or computations to data sources rather than collecting all raw data centrally.
• Secure multiparty computation: allowing parties to compute a result without revealing their private inputs to one another.
• Homomorphic encryption: enabling specified computations on ciphertext, with decryption producing a result corresponding to computation on plaintext.
• Trusted execution environments: isolating computation in hardware-supported protected areas.

PETs involve trade-offs. Noise can reduce statistical utility, federated systems can still leak information through model updates, and encrypted computation may require substantial resources. PET selection should therefore consider threat model, accuracy requirements, usability, governance and residual risk rather than relying on technology labels.

11. Applied Case: Illustrative University Health Portal

Background

A university operates an online health portal containing student appointments, diagnoses, prescriptions and billing information. The portal uses a cloud database, a mobile application and an external analytics service.

Problem

An administrator exports a full database to a shared cloud folder for analysis. The export contains direct identifiers and health information, is not encrypted, and remains accessible after the project ends. In addition, several former staff accounts remain active.

Analysis

The incident combines classification, access-control, sharing, retention and privacy failures. Health information should receive a restricted classification. The analytics service does not require names or full records, so the export violates minimisation. Persistent access violates least privilege and account lifecycle requirements. The shared folder creates an uncontrolled copy and may constitute a reportable breach if accessed by unauthorised persons.

Approach and solution

The university should immediately restrict the folder, preserve access logs, disable former accounts and determine whether the export was accessed. It should notify the privacy and incident-response teams for legal assessment. For future analysis, the university should separate identifiers, provide only necessary fields, use tokenized student references, encrypt files in transit and at rest, and enforce time-limited access. A retention rule should delete the analytical extract after the approved project. The cloud provider’s responsibilities and breach-notification support should be documented contractually.

Outcome

Assume the investigation finds that the file was downloaded by an unauthorised account. The university must assess applicable notification duties, inform affected individuals where required, offer appropriate support and record its reasoning. It should then conduct access reviews, implement automated deprovisioning, prohibit unmanaged exports and test DLP policies.

Learning points

Security controls must cover derived copies, not merely the primary database. Privacy risk is reduced by minimisation and separation of identifiers before analysis. Incident response requires both technical containment and accountable legal and ethical decision-making.

12. Contemporary and Professional Considerations

Cloud services, artificial intelligence and large-scale analytics increase the volume and movement of data. AI systems may reproduce sensitive information from training data, infer health or behavioural attributes, or expose personal data through prompts and outputs. Organisations should define approved data inputs, prohibit unnecessary personal information in public tools, evaluate providers, log usage and test for memorisation or unintended disclosure.

Professionals should also consider fairness, accessibility and power imbalances. A technically lawful process may still be ethically questionable if people cannot reasonably understand it or decline it without losing essential services. Governance should include documented ownership, risk assessments, supplier review, workforce training, independent audit and measurable improvement.

Best-Practice Checklist

• Maintain a current data inventory and flow map.
• Classify data and connect labels to enforceable handling rules.
• Apply least privilege, MFA, separation of duties and regular access review.
• Encrypt sensitive data and manage keys separately and securely.
• Use tokenization, masking or minimisation where full values are unnecessary.
• Protect backups with isolation, encryption and tested restoration.
• Monitor and govern data movement through risk-based DLP.
• Publish understandable notices and record lawful processing decisions.
• Define retention, legal-hold and secure-disposal procedures.
• Maintain a tested breach-response and notification plan.
• Evaluate PETs according to threat, utility and residual risk.
• Treat vendors, derived datasets, logs and AI systems as part of the data environment.

Chapter Summary

Data security protects confidentiality, integrity and availability, while privacy governs the fair, lawful and accountable use of information about people. Protection must extend across the entire lifecycle: collection, processing, storage, sharing, archiving and disposal. Classification connects sensitivity to practical handling requirements. Access control uses authentication, authorisation, least privilege and accountability to limit misuse. Encryption protects content, while tokenization and masking reduce exposure in particular contexts.

Backups support recovery but must themselves be protected and tested. DLP helps control inappropriate movement of sensitive information but requires careful tuning and privacy-aware monitoring. Privacy principles include purpose limitation, minimisation, accuracy, retention limitation, transparency, security and accountability. Consent is one possible lawful basis, not a universal solution. Retention schedules, secure disposal and breach-response procedures reduce legal and operational risk. PETs such as pseudonymization, aggregation, differential privacy and encrypted computation can reduce exposure, although each introduces limitations and trade-offs. Effective data governance combines technology, policy, law, ethics and continuous review.

Key Terms

Access control: Rules and mechanisms that determine who or what may perform actions on resources.

Anonymization: Processing intended to prevent reasonable identification of individuals.

Backup: An independent copy retained for restoration after loss or corruption.

Consent: A voluntary, informed and specific affirmative expression permitting specified processing.

Confidentiality: Protection against unauthorised disclosure.

Data classification: Assignment of sensitivity categories and handling requirements to data.

Data custodian: Person or organisation responsible for operating and protecting data systems.

Data minimisation: Collection and use of no more personal data than necessary.

Data subject: An individual to whom personal data relates.

Data-loss prevention: Controls that detect and restrict unauthorised movement or use of sensitive data.

Encryption: Transformation of plaintext into ciphertext using a cryptographic key.

Integrity: Protection of information from unauthorised or improper alteration.

Least privilege: Granting only the permissions needed for an authorised task.

Pseudonymization: Replacing identifiers with codes while retaining controlled re-linking capability.

Purpose limitation: Restricting processing to specified and legitimate purposes.

Recovery point objective: Maximum acceptable period of data updates that may be lost.

Recovery time objective: Target time for restoring a service or dataset.

Tokenization: Replacement of sensitive values with surrogate tokens.

Privacy-enhancing technology: Technology designed to reduce personal-data exposure while supporting legitimate functions.

Review Questions

Short Answer Questions

1. Distinguish confidentiality, integrity and availability.
2. What is the difference between encryption and tokenization?
3. Define recovery point objective and recovery time objective.
4. Why is consent not always required or sufficient for lawful processing?
5. State four principles of privacy-aware data governance.

Long Answer Questions

1. Explain how data classification should influence storage, transmission, access and disposal controls.
2. Compare DAC, MAC, RBAC and ABAC, including a suitable context for each.
3. Describe a secure backup strategy for a university’s critical information system.
4. Explain the relationship between privacy by design, minimisation and retention limitation.
5. Discuss the benefits and limitations of encryption, masking, tokenization and anonymization.

Analytical / Application Questions

1. A company sends an unencrypted customer export to an analytics vendor. Analyse the security and privacy failures and propose a corrected data flow.
2. A hospital discovers that a former employee downloaded patient records using an account that was never disabled. Develop an incident-response and governance plan.
3. An organisation wants to publish mobility statistics derived from individual location histories. Evaluate aggregation, pseudonymization and differential privacy, and recommend safeguards.

Multiple Choice Questions with Answers

Question 1

Which security objective concerns preventing unauthorised alteration of information?

A. Confidentiality

B. Integrity

C. Availability

D. Non-repudiation

Correct Answer: B. Integrity

Question 2

A system grants permissions according to job functions such as registrar, lecturer and auditor. Which model is being used?

A. Role-based access control

B. Mandatory access control

C. Discretionary access control

D. Anonymous access control

Correct Answer: A. Role-based access control

Question 3

What is the primary purpose of tokenization?

A. To permanently delete sensitive data

B. To replace sensitive values with controlled surrogate values

C. To guarantee that data is statistically anonymous

D. To increase network bandwidth

Correct Answer: B. To replace sensitive values with controlled surrogate values

Question 4

An RPO of six hours means that the organisation aims to:

A. Restore the service within six hours

B. Retain backups for six years

C. Lose no more than six hours of updates after a disruption

D. Permit six simultaneous administrators

Correct Answer: C. Lose no more than six hours of updates after a disruption

Question 5

Which practice best demonstrates data minimisation?

A. Collecting every available customer attribute for possible future use

B. Keeping all exports indefinitely

C. Collecting only fields necessary for the stated service

D. Publishing complete records after removing passwords

Correct Answer: C. Collecting only fields necessary for the stated service

Question 6

Which statement about consent is most accurate?

A. Consent is valid whenever a preselected box is present

B. Consent is always the only lawful basis for processing

C. Consent should be informed, specific, freely given and affirmative

D. Consent cannot be withdrawn after collection

Correct Answer: C. Consent should be informed, specific, freely given and affirmative

Question 7

Which control most directly reduces the risk posed by former employees retaining system access?

A. Automated account deprovisioning

B. Increasing screen brightness

C. Publicly publishing the access list

D. Disabling database backups

Correct Answer: A. Automated account deprovisioning

Question 8

Which technology is intended to add calibrated randomness to limit the effect of one person’s data on a published result?

A. Differential privacy

B. Role-based access control

C. Disk defragmentation

D. Static masking only

Correct Answer: A. Differential privacy

Question 9

Why should backups be tested through restoration exercises?

A. To make the original data public

B. To verify that data, applications, permissions and dependencies can actually be recovered

C. To eliminate the need for encryption

D. To ensure that retention periods are unlimited

Correct Answer: B. To verify that data, applications, permissions and dependencies can actually be recovered

Question 10

A development team needs realistic records but does not need real customer identities. Which approach is most appropriate?

A. Copying the production database without controls

B. Using masked or synthetic test data

C. Removing only the database title

D. Giving every developer administrator privileges

Correct Answer: B. Using masked or synthetic test data