Data Lifecycle Management and Data Privacy Principles

What it is

Data lifecycle management controls data from the moment it is created or collected until it is destroyed. Each stage has its own risks, and data kept longer than needed adds risk without adding value.

Data protection keeps data confidential, accurate and available. Data privacy is about the rights of individuals over their personal data and the rules for collecting and using it. Privacy needs security, but security alone does not make processing lawful or fair.

How it works

Risks and controls at each stage

Classification and ownership

Data classification labels data by sensitivity, for example public, internal, confidential and restricted, with handling rules for each level. The data owner, a business manager, decides the classification and who may access the data, while custodians in IT apply the controls.

Classification is the basis for proportionate protection.

Retention and destruction

A retention schedule sets how long each type of data is kept, based on legal, regulatory and business needs. Keeping data too long increases breach impact and may break privacy law; deleting it too early can breach record-keeping rules.

Media sanitization guidance such as NIST SP 800-88 describes three levels: clear, purge and destroy. The method must match the sensitivity of the data and whether the media will be reused.

Data protection controls

Common controls include encryption at rest and in transit, key management, access control, data loss prevention (DLP), masking and tokenization, backups and integrity checks. Pseudonymization replaces identifiers but can be reversed with extra information, so pseudonymized data is still personal data under GDPR. Anonymization removes the link to individuals irreversibly.

Privacy principles

The EU GDPR, Article 5, sets out principles that appear in many privacy laws:

Individuals have rights such as access, correction and erasure. Under GDPR, a personal data breach must normally be reported to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in risk to individuals.

Privacy by design and impact assessments

Privacy by design and by default (GDPR Article 25) means building privacy into systems from the start and using the most privacy-protective settings by default. A data protection impact assessment (DPIA) is required under GDPR Article 35 for processing likely to result in high risk to individuals, such as large-scale processing of sensitive data. The practitioner makes sure privacy risk is assessed early and fed into the risk register.

Controller and processor

The controller decides why and how personal data is processed. The processor processes it on the controller's behalf, such as a cloud payroll provider. The controller stays accountable and must have a contract that binds the processor to protect the data.

A worked example

A marketing team wants to reuse five years of customer purchase history to train a model that predicts which customers will leave. The data was collected for order fulfilment, and the retention schedule says purchase data should be deleted after three years.

The practitioner flags three issues: data beyond retention that should already be destroyed, a new purpose that may not be compatible with the original one, and a profiling activity that may need a DPIA. The data owner and the privacy officer review the legal basis, the old data is destroyed, and the project uses pseudonymized data after a DPIA.

How the exam asks about this

• "Who should decide the classification of customer data?" The data owner in the business.
• "What is the BEST way to reduce the impact of a future breach of old records?" Apply the retention schedule and securely destroy data no longer needed.
• "A new project will process sensitive personal data at scale. What should be done FIRST?" Perform a privacy or data protection impact assessment.