Data Privacy

Privacy is about appropriate use, while security is about keeping data safe from unauthorised access. A company can have perfect security and still breach privacy by selling data customers never expected to be sold. Privacy rests on principles such as fairness, transparency, purpose limitation, minimisation, accuracy, limited retention and accountability. These principles appear in laws such as the GDPR and India's DPDP Act, and in sector rules for health and finance. Data protection risk is the chance that an organisation breaks these duties and so faces fines, orders, litigation or lost trust. Programmes usually combine policies, notices, rights handling, vendor contracts, impact assessments and training. The term is often used interchangeably with data protection, though the latter leans towards the legal framework. Security teams cannot settle privacy questions alone, because the issue is whether the use itself was fair.

A telecom operator uses call location data, collected to run its network, to build an advertising product. The data is well secured, yet customers were never told of this use and have not agreed. A privacy review finds a breach of fairness and purpose rules, so the product is paused until notices and consent are fixed.