Data security

Data security protects information throughout its lifecycle, from collection and storage to use, sharing, archiving, and deletion. Its central objectives are confidentiality, integrity, and availability: preventing unauthorized disclosure, preventing improper alteration, and ensuring that authorized users can obtain dependable data when needed.¹

The scope includes databases, files, cloud services, backups, mobile devices, application programming interfaces, and paper records when they contain digitally managed information. Controls differ according to whether data is at rest, in transit, or in use. A public website, a payroll database, and a research archive therefore require different combinations of access restrictions, encryption, monitoring, and retention rules.

Data security is related to, but distinct from, privacy. Security limits unauthorized handling; privacy governs how personal information is collected, used, disclosed, and retained. Effective programs address both, while also considering business continuity and legal obligations.

Strong data security uses layered controls rather than a single protective product. Identity and access management applies least privilege, multifactor authentication, role separation, and periodic review so that people and services receive only the access they require.²

Encryption protects confidentiality when properly implemented and when keys are generated, stored, rotated, revoked, and backed up securely. Hashing can help detect unauthorized changes, while digital signatures provide evidence of origin and integrity; neither substitutes for access control or sound key management.³

Network segmentation, secure configuration, patch management, application testing, data-loss prevention, immutable backups, and audit logging add further layers. Modern zero-trust architectures treat authentication and authorization as continuing decisions rather than assuming that a device or internal network is inherently trustworthy.⁴

Data security begins with knowing what data exists, where it resides, who can access it, and how damaging its loss or alteration would be. Data inventories, classification schemes, threat modeling, vulnerability assessment, and supplier reviews help organizations prioritize controls according to risk rather than treating every record identically.

Incident response plans should define detection, containment, eradication, recovery, evidence preservation, communications, and notification responsibilities. Continuous monitoring can reveal unusual downloads, privilege changes, malware, or attempted access, but alerts become useful only when personnel and procedures can act on them. The NIST Cybersecurity Framework organizes these activities under Govern, Identify, Protect, Detect, Respond, and Recover.¹

Recovery is a security function as well as an availability function: tested backups, restoration procedures, alternate services, and lessons learned reduce the chance that an attacker can turn a local compromise into permanent data loss.

Data can remain exposed after deletion because storage media, snapshots, caches, logs, replicas, and backups may retain copies. Secure disposal therefore requires methods appropriate to the medium, such as cryptographic erasure or verified destruction, and must include cloud and outsourced environments.⁵

Encryption also has operational edge cases. Lost keys can make legitimate recovery impossible, while stolen keys can expose large datasets; key escrow, split administration, hardware security modules, and documented recovery procedures address different parts of this problem. Tokenization and format-preserving techniques can reduce exposure in testing or payment workflows, but substituted values still require protection.

Human and organizational behavior are frequent sources of risk. Excessive permissions, shared accounts, shadow copies, misconfigured storage, and insecure data exports can defeat expensive perimeter defenses. Data minimization, retention limits, secure defaults, staff training, and supplier contracts consequently matter as much as cryptographic technology. Privacy regulations may also impose safeguards and breach duties; the European Union's General Data Protection Regulation, for example, requires appropriate technical and organizational measures for personal-data protection.⁶

Confidentiality

The property that data is accessible only to authorized people, systems, or processes.

Integrity

The property that data remains accurate, complete, and protected from unauthorized alteration.

Availability

The property that authorized users can access data and services when required.

Encryption

The transformation of readable data into a protected form that requires a key or secret to recover.

Least privilege

The practice of granting only the access needed for a task and no more.

Data at rest

Data stored on a device, server, database, backup, or other persistent medium.