Data Security, Privacy, and Compliance

Data security is the practice of protecting digital information from unauthorised access, corruption, or theft throughout its entire lifecycle. Think of it as a set of controls that keep data safe from the moment it is created until it is securely destroyed. The goal of data security is to ensure three things, often called the CIA triad: confidentiality (only authorised people can see the data), integrity (the data is accurate and hasn't been tampered with), and availability (authorised users can access the data when they need it).

Confidentiality is achieved through methods like encryption (scrambling data so only someone with the correct key can read it), access controls (rules that decide who can view or use data), and authentication (verifying that a user is who they claim to be, for example with a password or fingerprint). Integrity is maintained using checksums (a mathematical value that changes if the data is altered), hashing (a one-way algorithm that creates a unique fingerprint of data), and version control (tracking changes so you can revert to an earlier version if needed). Availability is ensured through backups (copies of data stored separately), redundancy (having multiple systems so if one fails another takes over), and disaster recovery plans (procedures to restore data after a major failure).

Privacy is closely related to security but focuses specifically on how personal data about individuals is collected, stored, processed, and shared. Privacy is about respecting an individual's rights over their own information. In the European Union, the General Data Protection Regulation (GDPR) gives people the right to know what data is held about them, to have that data deleted (the right to erasure, often called the 'right to be forgotten'), and to be told if their data is breached. Privacy also involves concepts like data minimisation (only collecting the data you actually need), purpose limitation (only using data for the reason you collected it), and consent (getting permission from the individual before you use their data). In the United States, different laws cover different types of data. For example, the Health Insurance Portability and Accountability Act (HIPAA) protects medical information, and the California Consumer Privacy Act (CCPA) gives California residents rights over their personal data.

Compliance is the act of following all the laws, regulations, standards, and internal policies that apply to your organisation's data. It is not optional. Compliance involves regularly reviewing your security and privacy practices against requirements, documenting everything you do, and proving to auditors (independent inspectors) that you are following the rules. Common compliance frameworks include the Payment Card Industry Data Security Standard (PCI DSS) for credit card data, the Federal Information Security Management Act (FISMA) for US government agencies, and the SOC 2 framework for service organisations that handle customer data.

Access control is a critical part of all three pillars. There are three main models you need to know for the exam. Discretionary Access Control (DAC) means the owner of a file decides who can access it. Mandatory Access Control (MAC) uses a central authority to assign security labels to data and clearances to users, so only users with the right clearance can access data at a specific classification level. Role-Based Access Control (RBAC) grants permissions based on the user's role in the organisation, like 'manager' or 'analyst', rather than to individual people. RBAC is the most common model in business because it is easier to manage in large organisations. The principle of least privilege is a key concept: you should give users only the minimum access they need to do their job and no more.

Encryption is a fundamental tool for both security and compliance. Encryption uses an algorithm and a secret key to convert plaintext (readable data) into ciphertext (scrambled data). Only someone with the correct decryption key can turn ciphertext back into plaintext. Data can be encrypted at rest (when it is stored on a hard drive, database, or backup tape) and in transit (when it is moving across a network, like when you visit a secure website using HTTPS). Hashing is different from encryption: hashing is a one-way process that creates a fixed-length string of characters from any data. You cannot reverse a hash to get the original data. Hashing is used to verify that data has not been changed, for example by comparing the hash of a downloaded file with the hash published by the software vendor.

Why does this all matter for DA0-002? The exam will test your understanding of these concepts at a functional level. You need to know the difference between a threat (a potential danger), a vulnerability (a weakness), and a risk (the likelihood that a threat will exploit a vulnerability). You need to know the common types of attacks, like phishing (fraudulent emails trying to trick you into revealing information), malware (malicious software like viruses or ransomware), and social engineering (manipulating people into breaking security procedures). You also need to know how to classify data. Data classification is the process of labelling data based on its sensitivity. A common scheme is: public (anyone can see it, like a press release), internal (only employees can see it, like an internal policy), confidential (only specific people can see it, like salary information), and restricted (highly sensitive data that could cause serious harm if leaked, like customer credit card numbers). Understanding data classification helps you apply the right security controls to the right data.

Finally, you need to understand the data lifecycle: create, store, use, share, archive, and destroy. Security and privacy controls should be applied at every stage. For example, when data is created, you should classify it and encrypt it. When it is shared, you should ensure it is sent securely. When it is no longer needed, you should securely delete it using methods like degaussing (using a strong magnetic field to wipe magnetic media) or physical destruction (shredding hard drives). Failing to securely destroy data is a common way that data breaches happen, which is why compliance frameworks almost always include data disposal requirements.

Meet Priya, a data analyst at a mid-sized retail company called ShopSmart. ShopSmart sells clothes online and in physical stores. Priya's job includes handling customer data such as names, addresses, payment details, and purchase history. To pass an upcoming audit for PCI DSS (the standard for handling credit card data), the company needs to prove that it is protecting that data properly. Here is exactly what Priya and her IT team do step by step.

First, Priya's manager holds a meeting to classify all the data the company stores. They agree that customer credit card numbers are 'restricted', customer names and addresses are 'confidential', and product inventory levels are 'internal'. Each category gets different handling rules. For restricted data, encryption is mandatory both at rest and in transit. For confidential data, encryption is required only at rest unless it is being emailed, in which case encryption in transit is also required. For internal data, encryption is recommended but not mandatory. They document these rules in a data classification policy.

Next, the IT team implements Role-Based Access Control (RBAC) across the company's systems. Customer service representatives are given a role that lets them view a customer's name and order history, but not their credit card number. The accounting team gets a role that allows them to view payment amounts but only the last four digits of the credit card number. Only a handful of senior IT staff have a role that lets them see the full card number, and that access is tightly monitored. They also enforce the principle of least privilege. When a new hire joins the customer service team, they are automatically assigned the correct role. When an employee is promoted or leaves the company, their access is changed or revoked immediately.

After the access controls are in place, the team sets up encryption. They enable full-disk encryption on all company laptops using a tool like BitLocker or FileVault, so if a laptop is stolen, the data on it is unreadable. They set up a Virtual Private Network (VPN) so that any employee working from home connects through an encrypted tunnel. For credit card data stored in the database, they use column-level encryption so that even if someone breaks into the database, the card numbers appear as scrambled text. They also configure the company's website to use HTTPS, which encrypts data between the customer's browser and ShopSmart's web server.

Then, Priya and the IT team conduct a risk assessment. They identify potential threats: hackers trying to break into the database, employees accidentally emailing customer data to the wrong person, and a fire in the server room that could destroy all data. For each threat, they decide on a mitigation: they install a firewall and intrusion detection system for hackers, they run mandatory privacy training for all employees, and they set up daily backups to a secure off-site location. They also buy a backup generator to keep servers running during a power outage, ensuring availability.

Finally, the audit happens. An external auditor arrives and asks to see the data classification policy, the access control logs, the encryption configuration, and the risk assessment document. The auditor also tests a few things, such as checking that a terminated employee's account is actually disabled and that a customer's credit card data truly is encrypted in the database. Priya's team passes the audit because they have followed every step of the compliance framework. The auditor writes a report confirming that ShopSmart is PCI DSS compliant, which allows the company to continue accepting credit card payments. Without that compliance, the company could have been fined thousands of dollars per day or banned from processing credit cards altogether. Priya's careful work on data security, privacy, and compliance directly protected the company from financial disaster and legal trouble.