Security Program Management and Oversight · Topic 5 of 7
Compliance and Privacy
Security+ compliance: AML/CTF and anti-bribery training, attestations, non-compliance penalties, privacy rights, controller vs processor and legal hold.
- 5 min
- Compliance training covers data handling, AML/CTF and anti-bribery.
- An attestation confirms that controls are in place. An acknowledgement confirms that a policy was received and understood.
- Consequences include reputational damage, financial and legal penalties, contractual impact, sanctions and loss of license.
What it is
Compliance means meeting the requirements of laws, regulations, industry rules and contracts. Effective compliance needs trained staff, proof that rules are followed and a clear view of what happens when they are not.
Privacy is a large part of compliance. Privacy laws give people rights over their personal data, and legal duties such as legal holds decide how long data must be kept.
How it works
Compliance training
| Topic | What staff learn |
|---|---|
| Data handling | How to label, store, share and dispose of data according to its classification |
| Anti-money laundering and counter-terrorism financing (AML/CTF) | How to spot and report transactions that may hide criminal proceeds or fund terrorism |
| Anti-bribery | That offering or accepting bribes is illegal, and how gifts and hospitality must be handled |
AML/CTF training matters most in financial services, where laws require staff to report suspicious activity. Anti-bribery laws such as the US Foreign Corrupt Practices Act and the UK Bribery Act 2010 can apply to conduct abroad.
Compliance monitoring
| Element | Meaning |
|---|---|
| Attestations | A formal, signed statement that controls are in place or that rules were followed, often by a manager or an outside auditor |
| Acknowledgements | A record that a person received and understood a policy, such as signing the acceptable use policy |
An acknowledgement proves someone read the rule. An attestation is a stronger claim that the rule is actually being met.
Consequences of non-compliance
| Consequence | Meaning |
|---|---|
| Reputational damage | Loss of trust among customers, partners and the public |
| Financial | Fines from regulators, plus costs of remediation and lost business |
| Legal | Lawsuits, prosecution or personal liability for officers |
| Contractual | Breach of agreements, loss of contracts or penalty payments |
| Sanctions | Formal restrictions imposed by a regulator or government |
| Loss of license | Loss of the legal right to operate in a field, such as a bank losing its banking license |
Privacy rights and roles
| Item | Meaning |
|---|---|
| Right to be forgotten | A person may ask for their personal data to be erased, under laws such as the EU General Data Protection Regulation (GDPR) |
| Opt-in or opt-out | Opt-in needs the person's active consent before use. Opt-out allows use until the person objects |
| Data correction | A person may ask for inaccurate data about them to be corrected |
| Processing restrictions | The data is kept, but its use is limited, for example while a dispute is checked |
| Processing prevention | A person objects and processing for a purpose must stop, such as direct marketing |
| Controller vs. processor | The controller decides why and how personal data is processed, and the processor processes it on the controller's behalf |
| Ownership | The person accountable for a dataset, who decides its classification and who may use it |
The controller stays responsible even when a processor does the work. A contract with the processor must say how it handles requests such as deletion.
Legal compliance
| Item | Meaning |
|---|---|
| Legal hold | An instruction to preserve all data relevant to a lawsuit or investigation, suspending normal deletion |
| Legal orders | Court orders, subpoenas or warrants that require data to be produced or preserved |
| Data retention requirements | Laws and contracts that set how long records must be kept, and privacy laws that limit keeping data longer than needed |
A legal hold overrides the retention schedule. Deleting data under hold, even through routine cleanup, can bring serious legal penalties.
How the exam asks about this
- "A customer asks a company to erase all personal data it holds about her." -> The right to be forgotten.
- "Litigation is expected, and the company must stop its 90 day email purge for certain mailboxes." -> A legal hold.
- "Each new employee signs to confirm they have read the acceptable use policy." -> An acknowledgement.
What to remember for the exam
- Compliance training covers data handling, AML/CTF and anti-bribery.
- An attestation confirms that controls are in place. An acknowledgement confirms that a policy was received and understood.
- Consequences include reputational damage, financial and legal penalties, contractual impact, sanctions and loss of license.
- Opt-in requires active consent. Opt-out assumes consent until the person objects.
- Processing restrictions limit use of the data. Processing prevention stops processing for a purpose.
- The controller decides the purpose, and the processor follows instructions.
- A legal hold preserves data and overrides normal deletion.
- Retention requirements set minimum keeping periods, and privacy rules limit keeping data too long.
For a question about a person asking a company to erase their data, think right to be forgotten, controller and processor.
Common mistakes
Believing that compliance equals security. Meeting a minimum standard does not make an organization safe from every threat.
Confusing attestation and acknowledgement. Acknowledging a policy is not the same as attesting that controls work.
Mixing up controller and processor. The controller decides, and the processor acts on its behalf.
Letting routine deletion run during a legal hold. Preserved data must not be purged.
Treating opt-out as consent. Some privacy laws require opt-in consent for certain uses.
Storing data in another country can bring in extra laws. Know where personal data lives and whose data it is.
Check yourself
What is a legal hold?
An instruction to preserve data relevant to a legal case, which suspends normal deletion.
What is the difference between a data controller and a data processor?
The controller decides why and how personal data is processed, while the processor handles it on the controller's behalf.
What does an acknowledgement prove in compliance monitoring?
That a person received and understood a policy.
Topic 5 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.