Data privacy governs how personal information may be collected, used, shared, stored, and deleted by an organization today.
It is a set of duties toward people, not only a security technique, and it applies even when no intruder is involved.
How it works
A respectful program collects less, states a purpose, limits reuse, and lets people exercise the access or deletion rights that the law gives them.
Security supports privacy by reducing unauthorized access, but a perfectly guarded database can still be a privacy failure if the collection itself was excessive.
This page is not legal advice for a specific statute.
Organizations still need counsel for their jurisdiction, while the practical core remains purpose, minimization, access control, and honest retention.
Concrete examples
- A shop stops requiring a birth date for a purchase that does not need it.
- A newsletter keeps an unsubscribe path that actually removes the address within a stated time.
- An employer restricts who among staff can open health notes that were collected only for leave administration.
Protective measures
- Write the purpose for each category of personal data you collect, and do not reuse it for a quiet second purpose.
- Delete or return personal data when the purpose ends, and record how long each category is kept.
- Limit staff access to personal data to the roles that need it for the stated purpose.
- Give people a working route to ask what you hold and to request correction or deletion where the law allows.