Data privacy

Data privacy governs the lifecycle of information that can identify, describe, locate, or be linked to a person. Personal data may include names, identification numbers, device identifiers, location records, photographs, health information, financial details, and inferred characteristics. Some laws apply additional safeguards to sensitive categories such as medical, biometric, genetic, racial, or political information.²

Privacy decisions begin before collection. An organization should establish a specific purpose, collect only what is necessary, explain its practices clearly, and avoid using information in ways that conflict with the original purpose. Good governance also covers accuracy, retention limits, deletion, access controls, contracts with service providers, and procedures for responding to incidents and individual requests.

Modern privacy laws increasingly give individuals enforceable rights over information about them. The European Union's General Data Protection Regulation provides rights including access, rectification, erasure in defined circumstances, restriction of processing, data portability, and objection to certain processing.³ These rights are balanced against legal duties, freedom of expression, public interest, and the rights of others.

Legal models differ across jurisdictions. The United States uses a mixture of sector-specific federal laws, state statutes, and regulatory enforcement; the Health Insurance Portability and Accountability Act addresses protected health information in specified healthcare contexts, while the Children's Online Privacy Protection Act imposes requirements on services directed to children under 13.⁴ Consent is one lawful basis for processing, but it is not the only one and is not meaningful when obtained through deception or coercion.

Effective privacy depends on organizational governance as well as technical security. A privacy program commonly assigns responsibility, inventories data flows, classifies sensitive information, evaluates vendors, documents purposes and retention periods, and conducts privacy impact assessments for higher-risk projects. Privacy by design places these considerations into product development rather than treating them as an afterthought.⁵

Technical measures include data minimization, pseudonymization, encryption, access logging, role-based permissions, deletion automation, and separation of identifying information from analytical datasets. These controls reduce exposure but do not make data anonymous by themselves: seemingly harmless fields can be combined to re-identify people. A breach therefore represents both a security failure and a possible privacy violation, while lawful access can still become harmful through excessive collection or unexpected secondary use.

Privacy risks often arise from inference rather than from the direct disclosure of a name. Purchase histories, mobility traces, search behavior, and device signals can reveal health conditions, relationships, or political interests; aggregated data may also become identifying when combined with outside datasets. Automated decisions create a related concern because a person may be profiled without seeing the underlying data or understanding how an inference was made.

Children, patients, workers, migrants, and people using public services can face unequal consequences when refusing data collection is impractical. De-identification is therefore a risk-reduction technique, not a universal guarantee. International data transfers add another layer: organizations must assess legal protections, onward disclosures, and the ability of individuals to exercise rights across borders.³ Strong privacy practice ultimately combines restraint, transparency, accountability, and meaningful remedies.

Personal data

Information relating to an identified or identifiable person.

Sensitive personal data

Information that can create heightened risks of discrimination, harm, or intrusion, often receiving additional legal protection.

Data minimization

Collecting and retaining no more personal information than is necessary for a defined purpose.

Pseudonymization

Processing data so it cannot be attributed to a person without additional separately held information.

Privacy impact assessment

A structured evaluation of how a project may affect people’s privacy and how those risks can be reduced.