The Data Lifecycle and Data Governance

Vocabulary flashcards covering the data lifecycle stages, data governance roles, and categories of legally protected information.

Data lifecycle

An important model that security teams consider when protecting information, describing how data flows through an organization from the moment it is created until it is no longer useful across five stages: Collect, Store, Use, Archive, and Destroy.

Data governance

A set of processes that define how an organization manages information, often including policies that specify how to keep data private, accurate, available, and secure throughout its lifecycle.

Data governance policy

A specific policy included in most security plans that outlines how information will be managed across an organization, defining procedures that should be followed and placing limits on who or what can access data.

Data owner

The person that decides who can access, edit, use, or destroy their information.

Data custodian

Anyone or anything that is responsible for the safe handling, transport, and storage of information, primarily tasked with maintaining security and privacy rules to ensure data is not damaged, stolen, or misused.

Data steward

The person or group that maintains and implements data governance policies set by an organization.

Personally Identifiable Information (PII)

Any information used to infer an individual's identity, or information that can be used to contact or locate someone.

Protected Health Information (PHI)

Information that relates to the past, present, or future physical or mental health or condition of an individual, regulated by HIPAA in the U.S. and by GDPR in the EU.

Health Insurance Portability and Accountability Act (HIPAA)

A U.S. regulatory law that defines and regulates Protected Health Information (PHI) as information relating to the past, present, or future physical or mental health or condition of an individual.

General Data Protection Regulation (GDPR)

An EU regulation that regulates Protected Health Information (PHI) under a definition similar to HIPAA.

Sensitive Personally Identifiable Information (SPII)

A specific type of PII that falls under stricter handling guidelines and should only be accessed on a need-to-know basis, such as a bank account number or login credentials.