Lesson 26 - Summarize Elements of Effective Security Compliance

Compliance

acting in accordance with rules, laws, policies, and obligations

Jurisdiction

- power or right to exercise authority over a person, subject matter or territory

- in cyber, it perstains location of data and systems, type of data, residence of data owners and residence of data subjects

Consequences of Non-compliance

fines, sancitons, resource utilization, loss of license, contractual impact, reputational damage

Compliance Monitoring

- active process used for early detections of non-compliance and aread of improvement

- includes manual inspetions, audits, data analysis, automated systems, etc...

Privacy

the right of an individual to control the use of their personal information

Data Minimzation

limits data collection to only what is absolutely necessary for a specific purpose

Collection Limitation

OECD privacy principle that states the collection of data should be obtained legally and with the consent of the data subject

Data Quality

OECD privacy principle that states personal data should be relevant to the purpose and should be accurate, complete, and up to date

Purpose Specification

OECD privacy principle that states the reason for collection the personal data should be specified before or at the time of data collection (not after)

Use Limitation

OECD privacy principle that stated personal data should only be used for the stated purpose unless with the consent of the data subject or authority of the law

Security Safeguard

OECD privacy principle that states personal data should be protected by reasonable security safeguards

Right to be Forgotten

an individual's right to have their PI removed from online (e.g search engine results)

GDPR (General Data Protection Regulation)

- protects EU and EEA (European Economic Area) residents from unlawful data collection/processing

CCPA (California Consumer Privacy Act)

- Protects California residents' personal data and privacy rights

- has a broad definitino of what "personal information" is

Data Controller

GDPR Privacy Role that determines the purpose for which and means by which personal data is processed

Data Processor

GDPR Privacy Role that processes personal data on behalf of the Data Controller

DPO (Data Protection Officer)

- GDPR Privacy Role that ensures and organization is in compliance with privacy regulations defined in the GDPR

- must be independent

Data Masking

technique used to prevent sensitive data by replacing it with fictional or de-identified data

Tokenization

replacing original data with an unrelated value of the same length and format

Anonymization

privacy enhancing technique where PII is altered so that it can never be related back to an individual

Pseudo-Anonymization

privacy enhancing technique where PII is substituted with a reversible, consistent value

Privacy Statement

public notice that describes what information may be collected and how it will be used (a.k.a privacy notice)

PIA (Privacy Impact Assessment)

- decision making tool used to identify and mitigate privacy risks

- determines what information is collected and why + how is will be maintained and secured