Legal, Risk and Compliance · Topic 2 of 6
Privacy Issues and Requirements
CCSP privacy: contractual vs regulated data, PII and PHI, GDPR, HIPAA, FERPA, PIPEDA and India's DPDP Act, ISO/IEC 27018, GAPP and impact assessments.
- 5 min
- Regulated data obligations come from law; contractual ones from agreements such as PCI DSS.
- GDPR: 72 hour breach notice to the authority, DPIAs for high risk, fines up to €20 million or 4%.
- HIPAA protects PHI and needs business associate agreements; FERPA protects student records.
What it is
Privacy is about the rights of people whose data an organization holds. In the cloud, personal data may be processed by providers and subprocessors in many countries, so the customer must know which laws apply, which standards help, and how to assess privacy risk before processing begins.
How it works
Contractual versus regulated private data
| Type | Source of obligation | Example |
|---|---|---|
| Regulated | Law or regulation; penalties from authorities | PHI under HIPAA, personal data under GDPR |
| Contractual | Agreements between parties; remedies through contract | Cardholder data under PCI DSS, customer data protected by a confidentiality clause |
PII (personally identifiable information) is information that identifies or can identify a person. PHI (protected health information) is health information about an individual held by a covered entity or business associate under HIPAA. Some data is both regulated and contractual at once.
Country-specific legislation
| Law | Jurisdiction | Key points |
|---|---|---|
| GDPR | EU and EEA, and organizations offering goods or services to or monitoring people there | Lawful basis, data subject rights, breach notice to the supervisory authority within 72 hours, DPIAs, fines up to €20 million or 4% of global annual turnover |
| HIPAA | US healthcare | Privacy and Security Rules for PHI; business associate agreements with providers handling PHI; HITECH strengthened breach notification |
| FERPA | US education | Protects student education records at institutions receiving federal funding; gives parents and eligible students access and control |
| PIPEDA | Canada, private sector | Consent based, built on ten fair information principles; organizations remain accountable for data sent to processors |
| Digital Personal Data Protection Act, 2023 | India | Consent and legitimate uses, duties of data fiduciaries, rights of data principals, a Data Protection Board |
Jurisdictional differences in data privacy
- Comprehensive versus sectoral: the EU has one general law; the US relies mostly on sector laws (HIPAA, FERPA, GLBA) and state laws.
- Cross border transfers: GDPR allows transfers to countries with an adequacy decision, or with safeguards such as standard contractual clauses or binding corporate rules.
- Definitions: what counts as personal or sensitive data varies.
- Breach notification: deadlines and thresholds differ by law.
Customers must map where providers store and access data, including subprocessors and support staff locations.
Standard privacy requirements
| Standard | What it provides |
|---|---|
| ISO/IEC 27018 | Code of practice for public cloud providers acting as PII processors: process only on customer instruction, no use for marketing without consent, disclose subprocessors, notify breaches, return or delete data |
| ISO/IEC 27701 | Requirements for a privacy information management system, closely aligned with ISO/IEC 27001 |
| GAPP | Generally Accepted Privacy Principles from AICPA and CICA: ten principles, now succeeded by the AICPA Privacy Management Framework |
| GDPR principles | Lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability |
The ten GAPP principles are management; notice; choice and consent; collection; use, retention and disposal; access; disclosure to third parties; security for privacy; quality; and monitoring and enforcement.
Privacy impact assessments
A privacy impact assessment (PIA), called a data protection impact assessment (DPIA) under GDPR, evaluates how a project will affect privacy before it starts. GDPR requires a DPIA where processing is likely to result in a high risk to individuals.
A PIA typically covers:
- A description of the processing, its purpose and data flows.
- Necessity and proportionality.
- Risks to individuals' rights and freedoms.
- Measures to address the risks.
- Sign-off and review, with advice from the data protection officer where there is one.
In the cloud, the PIA should include provider location, subprocessors, access by provider staff, and exit arrangements.
A worked example
A Canadian university plans to move student records and counselling notes to a SaaS platform hosted in the US. It also has students from the EU studying online.
The privacy office runs a PIA. It identifies PIPEDA and provincial obligations, GDPR for EU students monitored online, and FERPA if the institution receives US federal funding. The PIA recommends a provider aligned with ISO/IEC 27018, contract terms on subprocessors and breach notification, encryption with university controlled keys for counselling notes, and transfer safeguards for EU data.
How the exam asks about this
- "Which standard is a code of practice for protecting PII in public clouds acting as processors?" ISO/IEC 27018.
- "When must a DPIA be performed under GDPR?" Before processing that is likely to result in a high risk to individuals.
- "Cardholder data protected under PCI DSS is an example of what type of private data?" Contractual private data.
What to remember for the exam
- Regulated data obligations come from law; contractual ones from agreements such as PCI DSS.
- GDPR: 72 hour breach notice to the authority, DPIAs for high risk, fines up to €20 million or 4%.
- HIPAA protects PHI and needs business associate agreements; FERPA protects student records.
- ISO/IEC 27018 is for PII in public clouds; 27701 is a privacy management system.
- Run the PIA before processing starts and include provider locations and subprocessors.
Moving data to a provider does not move accountability. Under GDPR and PIPEDA the organization that collected the data remains accountable for what its processors do.
Common mistakes
Treating PCI DSS as law. It is a contractual standard enforced through card brand agreements.
Running the PIA after go-live. Its value is changing the design before processing begins.
Assuming a US company only needs US law. GDPR applies to organizations outside the EU that offer goods or services to, or monitor, people in the EU.
Check yourself
What is the difference between PII and PHI?
PII is any information that can identify a person, while PHI is health information about an individual protected under HIPAA when held by covered entities or business associates.
What safeguards allow GDPR transfers to countries without an adequacy decision?
Appropriate safeguards such as standard contractual clauses or binding corporate rules.
What is GAPP?
The Generally Accepted Privacy Principles from AICPA and CICA, ten principles for privacy programs, now succeeded by the AICPA Privacy Management Framework.
Topic 2 of 6 in Legal, Risk and Compliance
Test yourself on Legal, Risk and Compliance
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.