CDPSE · Domain 4
Privacy Engineering
About 39% of the exam
Privacy by design: the seven principles
- Default: optional consents unchecked, required fields separated
- Auto-enrolled sharing with buried opt-out is a dark pattern
- Design phase is the cheapest place to change
- The principles work together, not separately
- Proactive not reactive
- anticipate and prevent, not remediate
- Privacy as the default
- protected with no user action
- Embedded into design
- part of the architecture, not bolted on
- Full functionality
- positive-sum, not privacy versus features
- End-to-end security
- full lifecycle protection
- Visibility and transparency
- open, documented, independently verifiable
- Respect for user privacy
- user-centric defaults and controls
Privacy embedded in architecture is harder to bypass and cheaper to maintain than features added after launch
Privacy in the SDLC
- Requirements
- Threat model
- Design review
- Build with patterns
- Test
- Release gate
- Monitor
- LINDDUN: linkability, identifiability, non-repudiation, detectability
- Also disclosure, unawareness, non-compliance
- Design patterns: reusable proven solutions
- Control catalog mapped to architecture elements
- Automated privacy tests in the pipeline
- Architecture review gate before production
Architecture patterns
- Classify and tag at ingestion
- Gateway strips identifiers before third parties
- Central catalog indexes data for DSARs
- Logical zones with attribute-based access
- Row-level security and dynamic masking
- Controlled interfaces with export limits
- Wrappers and gateways retrofit legacy systems
- Govern metadata like primary data
- Crypto-agile design for post-quantum change
De-identification toolkit
Techniques
- Pseudonymization
- reversible with a separate key
- Anonymization
- irreversible, out of scope
- Generalization
- exact age becomes a range
- Suppression
- remove rare outliers
- Aggregation
- group totals, minimum cell size
- Synthetic data
- statistical twin, no real people
Formal models
- k-anonymity
- hide among k minus one others
- l-diversity
- varied sensitive values per group
- t-closeness
- group distribution matches overall
- Differential privacy
- calibrated noise, provable bound
- Epsilon
- privacy budget, lower is stronger
- Local DP
- user perturbs before sending
Why it fails
- Homogeneity attack beats k-anonymity
- Linkage with public auxiliary data
- Hashing low-entropy values is reversible
- Synthetic generators can memorize records
- Motivated intruder test checks the claim
- Noise scaled to query sensitivity
Advanced privacy technologies
- Homomorphic encryption
- compute on ciphertext, slow
- Secure multiparty computation
- joint result, inputs stay private
- Private set intersection
- reveal only the overlap
- Federated learning
- updates travel, raw data stays
- Secure aggregation
- server sees only the sum
- Confidential computing
- protects data in use
- Zero-knowledge proof
- prove a fact, reveal nothing
- On-device processing
- minimize what leaves the device
Encryption and keys
- In transit
- TLS, VPN, mutual TLS between services
- At rest
- storage, database, field level
- Client-side
- provider and its admins stay blind
- End-to-end
- only endpoints read messages
- Deterministic
- equality search, leaks equal values
- HSM and KMS
- tamper-resistant keys, central policy, audit
- Crypto-shredding
- destroy the key, data gone
- Integrity
- MAC or signature detects tampering
Separate key custodians from data administrators; whoever holds the key holds the data
Tokenization, masking, hashing
- Tokenization
- random surrogate, vault maps back
- Scope reduction
- token-only systems leave PCI scope
- Format-preserving
- token keeps the field shape
- Static masking
- irreversible copy for testing
- Dynamic masking
- hidden on the fly by role
- Salted hash
- unique salt defeats rainbow tables
- Keyed hash
- consistent match, key protects it
- Plain hash of phone
- brute-forced from a small input space
Identity and access for privacy
Access models
- Least privilege
- only the fields the task needs
- RBAC
- roles, beware the super-role
- ABAC
- attributes: role, sensitivity, purpose, context
- Purpose binding
- grant tied to a documented purpose
- Segregation of duties
- extractor cannot approve extraction
- Zero standing privilege
- elevated access only on demand
- Zero trust
- verify every access, micro-segment
Operations
- Recertification catches privilege creep
- Approval workflow before personal data access
- PAM: approved, time-bound, recorded, auto-revoked
- Break-glass logged, alerted, reviewed after use
- Service accounts scoped, secrets rotated
- Role mining removes unused permissions
- Consent state enforced at the authorization layer
Identity
- Federated SSO: provider sees which services
- MFA before exporting personal data
- Proportionate identity checks for DSARs
- Verification data minimized, then deleted
- Session cookies HttpOnly, Secure, short-lived
- Consent screens: specific data, purpose, granular
DLP, logging, monitoring
- DLP inspection at the environment egress
- Discovery scanning finds data at rest
- Endpoint DLP controls removable media
- Monitor first, tune, then block
- Log personal data access and consent changes
- Tamper-evident logs hide nothing
- Logs are personal data: minimize, expire
- Anomaly alerts on bulk access
Cloud and infrastructure
- Customer-held keys blind the provider
- Default encryption plus least-privilege buckets
- Segregate special category into tighter stores
- Isolated hardened zone for personal data
- WORM storage locks mandated retention
- Purge policies on raw lake zones
- Residency: where; sovereignty: whose law
- Localization: keep regulated data in-region
- Hybrid: regulated local, aggregates central
Consent and preference technology
- Consent tracked per purpose across systems
- Withdrawal propagates in near real time
- Record who, when, what, version
- Opt-in before reading the advertising identifier
- Honor browser and platform opt-out signals
- First-party aggregated measurement replaces third-party cookies
- Unchecked optional consents by default
Vendors, pipelines, integrations
- Privacy as code in CI/CD
- Synthetic or masked data in test
- Third-party SDK and API flows reviewed
- Purpose-limited APIs at integration points
- Mutual TLS and field encryption between services
- Shared responsibility written down
- Sub-processor changes need authorization
- Review vendor claims of anonymous analytics
Rapid recall: pick the technology
- Provider must not read
- client-side encryption, own keys
- Compute without decrypting
- homomorphic encryption
- Joint result, private inputs
- secure multiparty computation
- Overlap only
- private set intersection
- Publish statistics safely
- differential privacy
- Realistic test data
- synthetic or static masking
- Keep field format
- format-preserving tokenization
- Train without pooling data
- federated learning, secure aggregation
Reference strip: design, PETs, crypto, access, monitoring
Design
- Seven principles, default is protected
- LINDDUN for privacy threats
- Patterns and control catalog
- Review gate before production
- Classify at ingestion
De-identification
- Pseudonymous stays personal
- k-anonymity, l-diversity, t-closeness
- Differential privacy, epsilon budget
- Synthetic data, check memorization
Cryptography
- Client-side keys, provider blind
- HSM, KMS, separate custodians
- Crypto-shred to destroy
- Homomorphic, MPC, confidential computing
Access
- Least privilege, purpose binding
- ABAC when purpose matters
- PAM, break-glass, recertification
- Consent enforced at authorization
Monitoring
- DLP at egress, discovery at rest
- Tamper-evident access logs
- Logs minimized and expired
- Consent withdrawal propagates fast
Quick exam traps
- Trap: Privacy by default is satisfied by offering a settings page
- Trap: k-anonymity guarantees no record can be linked to a person
- Trap: Federated learning reveals nothing about the training data
- Trap: Hashing identifiers turns a dataset anonymous
- Trap: RBAC alone enforces purpose limitation
- Trap: Provider-managed encryption stops the provider reading the data
- Trap: Privacy review belongs at the end, just before release
- Trap: Synthetic data carries no re-identification risk
cybercertprep.com · original revision sheet written from the public body of knowledge