Select Two (Multi-Select) Questions

Selection of quasi-identifiers

These are the target of generalization.

The chosen k-value

Higher k increases privacy but decreases utility.

The generalization level

More generalization reduces utility.

Kubernetes Secrets management

Protects keys and passwords.

Kubernetes Network Policies

Restricts lateral movement.

Defining appropriate sensitivity bounds for the input data

Sensitivity bounds dictate the amount of noise required.

Setting a low Epsilon value for higher privacy loss limit

Lower epsilon provides a stronger privacy guarantee.

Enabling Delta parameter for probabilistic privacy guarantees

Delta represents the probability of breaking the epsilon guarantee.

Regulatory/Legal requirements

Laws often dictate mandatory retention periods.

Statutory limitations periods

Legal liability periods determine how long records must be kept.

Operational business utility

Data needed for business is retained, otherwise it should be minimized.

Regulatory non-compliance

Failure to dispose of data properly leads to fines.

Increased risk of data breach impact

Holding onto unnecessary data increases liability.

Reduction in overall data volume

Less data stored is a direct indicator of minimization.

Decrease in records containing PII

Minimizing PII-specific records reduces the privacy risk profile.

Purpose of processing

Required for transparency and accountability.

Location of the data

Required for understanding risk and residency.

Anonymization of records

Removes the link to the identity, minimizing privacy risk.

Purging of obsolete data

Removes unnecessary data from the system.

Identifying sensitive data elements

The first step in classification.

Applying policy controls based on labels

The purpose of classification.

Assigning classification labels

The core action of the process.

Improved application of security controls

Allows applying tighter controls to sensitive data.

Automated enforcement of retention policies

Labels help trigger correct disposal rules.

Storage location

Helps locate the data to process the request.

Data owner/steward

Helps direct the request for fulfillment.

Data category/type

Helps determine the scope of a request.

Data Processing Agreements (DPAs) with third-party vendors.

DPAs are legally required for managing third-party data processing.

A public-facing privacy notice.

Transparency via a privacy notice is a global regulatory standard.

A record of processing activities (ROPA).

ROPA is a core accountability document required by GDPR.

Data minimization

Reducing PII collection is essential.

Transparency of processing

Users must know how their data is used.

Pseudonymization

Replaces identifiers to allow processing without direct link to identity.

Data masking

Hides specific values during processing.

Encryption

Protects data from unauthorized access.

The organization's stated risk appetite.

Privacy controls must be balanced against the organization's business goals and risk tolerance.

Applicable legal and regulatory requirements.

Strategy must be anchored in the legal obligations relevant to the business.

The consistency of policy application across the enterprise.

Consistent application indicates a mature, managed program.

The degree of integration of privacy in automated processes.

Automation suggests higher, more consistent maturity.

The depth of continuous monitoring and reporting.

Ongoing monitoring is a hallmark of high-maturity programs.

Column-level security

Hides specific sensitive columns.

Row-level security

Limits access to specific records.

Patching security vulnerabilities

Prevents PII breaches.

Continuous privacy monitoring

Detects drift in compliance.

Periodic DPIA review

Ensures risk remains managed.

Pseudonymization

Separating identifiers from data reduces risk.

Anonymization

Irreversible transformation protects identity.

Default privacy settings

Ensuring the most restrictive settings are enabled by default is a proactive control.

Data minimization

Collecting only what is necessary is a core PbD principle.