What does GDPR primarily regulate?

How organizations collect, process, and protect EU personal data

The minimum password length required for all software

Network bandwidth allocation for international companies

What is the purpose of a security audit?

Independently verifying that controls meet defined security standards

Automatically patching every vulnerability found during review

Replacing the need for employee security training

In risk management, what does risk mitigation mean?

Taking action to reduce a risk's likelihood or impact

Accepting every identified risk without further action

Transferring all responsibility for risk to a third party

Why do frameworks like PCI DSS matter for payment-handling businesses?

They set required security standards for protecting cardholder data

They are optional guidelines with no enforcement consequences

They apply only to banks, never to merchants

Cyber Security Privacy and Compliance

Privacy and compliance are about the rules — legal and organizational — that govern how personal data is collected, used, and protected, with regulations like the GDPR setting the baseline many organizations now design around.

Privacy vs. Security: Related but Different

Security and privacy overlap constantly but answer different questions. Security asks: is this data protected from unauthorized access, tampering, or loss? Privacy asks: do we have the right to collect this data in the first place, are we using it only for the purpose the person agreed to, and can that person see, correct, or delete it? Compliance is the layer on top of both — the specific legal and contractual obligations an organization must meet, which are usually built from a mix of privacy principles and security requirements.

GDPR: The EU's Data Protection Law

The General Data Protection Regulation (GDPR) is a European Union law, in effect since 2018, that governs how personal data of people in the EU is collected and processed. Its reach isn't limited to companies based in Europe — any organization, anywhere, that processes the personal data of people in the EU can fall under it. GDPR is built on a handful of core principles: process data lawfully and transparently, collect it only for specified purposes (purpose limitation), collect no more than necessary (data minimization), keep it accurate, keep it no longer than needed (storage limitation), protect it (integrity and confidentiality), and be able to demonstrate compliance (accountability).

Right of access — individuals can ask what personal data an organization holds about them.
Right to rectification — individuals can have inaccurate data corrected.
Right to erasure ('right to be forgotten') — individuals can request deletion of their data in certain circumstances.
Right to data portability — individuals can obtain their data in a usable format to move to another provider.
Right to object — individuals can object to certain kinds of processing, such as direct marketing.
Breach notification — organizations must generally notify the relevant regulator within a tight window (72 hours under GDPR) once aware of a qualifying personal data breach.

Other Privacy Regulations Around the World

GDPR was influential, but it isn't the only privacy law that matters. In the United States, the California Consumer Privacy Act (CCPA), later expanded by the California Privacy Rights Act (CPRA), gives California residents rights over their personal information that are conceptually similar to some GDPR rights, such as knowing what's collected and requesting deletion, though the legal details differ. Many other countries and U.S. states have since passed their own privacy laws, and sector-specific rules add another layer — healthcare data in the U.S., for example, is separately governed by HIPAA.

Regulation	Region / scope	Primary focus
GDPR	European Union (and anyone processing EU residents' data)	General personal data protection and individual rights
CCPA / CPRA	California, USA	Consumer rights over personal information collected by businesses
HIPAA	United States	Protection of health information held by covered healthcare entities

Building Compliance Into Development

Treating privacy as an afterthought is expensive to fix later, so many teams adopt 'privacy by design' — considering data protection from the earliest stages of a feature rather than retrofitting it before a launch. In practice this means collecting only the data a feature actually needs, documenting where personal data flows through the system, applying access controls and encryption consistent with the data's sensitivity, and running a data protection impact assessment for features that process sensitive or large-scale personal data.

Note: Non-compliance isn't just a reputational risk. GDPR penalties, for example, can reach a percentage of an organization's global annual revenue for serious violations — regulatory exposure of that scale is a legitimate business risk, not only a legal or engineering concern.

Note: When in doubt about whether a data field is 'personal data,' assume it is. Definitions in most modern privacy laws are broad and cover anything that can identify or be linked back to a specific person, which is often wider than engineers initially expect.

Exercise: Cyber Security Risk & Compliance

What is the main purpose of a risk assessment?

Keep Going

Cyber Security Interview QuestionsPractice real questions asked for Cyber Security Cybersecurity Analyst SalarySee what Cybersecurity Analyst roles pay in the market Auto Apply for JobsApply to open roles related to Cyber Security and tweak your resume