Data Privacy, Data Security, and Compliance

The terms data privacy, data security, and compliance are used interchangeably with sufficient frequency in organisational and regulatory discourse that their distinct meanings and governance purposes are often obscured. This conflation creates practical problems for the information security and compliance practitioner, because the three concepts address different aspects of the organisation’s obligations and capabilities, require different governance disciplines to manage effectively, and produce different consequences when they fail. Understanding the distinctions clearly, and governing the interdependencies deliberately, is essential for the ISO and compliance professional who must ensure that the organisation’s approach to information protection is coherent, comprehensive, and capable of satisfying the increasingly demanding expectations of regulators, customers, and the individuals whose data the organisation processes.

Data Privacy #

Data privacy is concerned with the proper collection, handling, use, and sharing of individuals’ personal information. It is fundamentally a governance and legal discipline rather than a technical one, rooted in the legal principles and individual rights frameworks that determine what information is considered sensitive, under what conditions it may be collected, for what purposes it may be used, with whom it may be shared, and for how long it may be retained. Many jurisdictions treat data privacy as a fundamental right rather than merely a regulatory preference, and the legal frameworks that give effect to this right impose obligations on organisations that process personal data which go well beyond the technical security measures that data security addresses.