Global Data Privacy Essentials: Safeguarding Personal Info

Personal information means data relating to an identifiable living person (and sometimes a juristic person), distinct from confidential information under data privacy law.

Explore a guideline for identifying personal information. The checklist covers names, numbers, online identifiers, contact details, demographics, gender and sexuality, health, biometrics, history, belief or opinion, and correspondence.

Identify additional levels of personal information and explain how data privacy law protects special categories, including health, biometric data, race, religion, political views, criminal history, and children's data.

Define processing as any transaction or activity involving personal information, automated or not, and note that it spans the information life cycle from collection to destruction.

Explore the life-cycle categories of processing personal information, from collection and recording to storage, use, restriction, and destruction, with examples illustrating data controller roles and the right to be forgotten.

The data subject, including natural and juristic persons, holds extensive rights such as notification of collection and security breaches, access, correction or deletion, and objections to processing and direct marketing.

Identify the data controller as the ultimate responsible party for processing personal information, who determines purpose and means, even when outsourcing, and distinguish controllers from processors.

The data protection authority, an information regulator, oversees powers, duties, and functions, promotes understanding, educates on data protection, monitors compliance, handles complaints, and requires incident reporting by controllers.

Describe how the data protection authority enforces data privacy law, grants remedies, accepts complaints, and pursues civil proceedings, with powers to obtain warrants and compel testimony.

Learn about sanctions and criminal offences in data privacy law, from notifying the data protection authority to obstructing warrants, with penalties for less serious and serious offences.

Examine four stages of the personal data processing life cycle and how processing conditions affect them from a data subject’s perspective and workplace responsibilities.

Explore how organizations collect personal information for services or employment, ensure collection with consent, and limit data to relevance; learn to object, delete, or file a data subject access request.

A privacy notice explains what data is collected, who collects it, whether disclosure is mandatory, data sharing, and users’ rights to access, correct, delete, and be informed of related rights.

Explore how organizations map personal information to justify processing, assess legitimate interests, and safeguard data with security measures, while illustrating risks of informal data handling.

Everyone plays a role in privacy compliance; leaders implement the program, assign roles, and ensure resources and training. Understand data subject rights and basic security practices, including working from home.

Learn how human resources shape the organization’s privacy footprint by designating information owner, safeguarding personal and sensitive data, and managing employment records and health information with external agencies and regulations.

Clarify the information owner role in sales or marketing, outline telemarketing and sharing restrictions, and describe consent, opt-in, and opt-out requirements for marketing communications and data trades.

Explore how social engineering uses psychological tricks to persuade users to reveal confidential information. Learn how attackers build trust over time by asking harmless questions and combining tactics.

Explore types of social engineering attacks, including phishing, spearphishing, pretexting, baiting, and scareware, and learn how attackers manipulate urgency, trust, and fear to steal data.

Learn social engineering countermeasures: never share passwords or personal data via email, verify requests, avoid unsolicited help, strengthen spam filters, keep devices secure with updates and MFA, and verify offers.

Learn essential good user habits to protect personal data, including avoiding unapproved third-party uploads, creating strong unique passwords, and enabling two-factor authentication.

Raise security awareness through comprehensive training and resources, fostering a positive culture that encourages employees to speak up, ask questions, and collaborate to enforce secure behaviors.