Security and Privacy Basics — Lesson 5
Privacy, PII, Encryption, and Compliance
Learning Objectives
- 1Identify what constitutes personally identifiable information (PII).
- 2Understand encryption in transit and at rest.
- 3Know the basics of GDPR, CCPA, and data privacy obligations.
Personally identifiable information
PII is any data that can identify a specific individual: name, email, phone number, address, social security number, financial information, health information, biometric data, and IP addresses. Some PII is obviously sensitive (SSN, health records). Other PII becomes sensitive in combination (name + birthday + address).
If your business collects PII — and nearly every business does through forms, accounts, purchases, and email lists — you have obligations to protect it. These obligations exist regardless of your company size. A five-person company that loses customer data faces the same type of consequences as a large enterprise.
Know what PII your business collects, where it is stored, who has access, how long it is kept, and how it would be deleted if requested. This inventory is the foundation of privacy compliance and the first thing a regulator or auditor will ask for.
Encryption: in transit and at rest
Encryption in transit means data is protected while moving between systems — from a browser to a server, from one server to another, or from an app to an API. SSL/TLS (the padlock in your browser) is the most common form of encryption in transit. Any data transmission that crosses the internet should be encrypted in transit.
Encryption at rest means data is protected while stored — in a database, on a hard drive, or in cloud storage. Even if someone gains physical access to the storage, encrypted data is unreadable without the encryption key.
For business leaders, the key questions are: Is data encrypted in transit (does the connection use HTTPS)? Is data encrypted at rest (does the storage provider encrypt stored data)? Who controls the encryption keys? What encryption standards are used? These questions should be part of any vendor security evaluation.
GDPR, CCPA, and privacy obligations
GDPR (General Data Protection Regulation) is the European privacy law that affects any business that handles data of EU residents. It requires clear consent for data collection, the right for individuals to access and delete their data, breach notification within 72 hours, and documented data processing practices.
CCPA (California Consumer Privacy Act) gives California residents the right to know what personal information is collected, the right to delete it, the right to opt out of its sale, and protection against discrimination for exercising these rights. Similar laws exist or are emerging in many other US states.
Regardless of which specific regulations apply to your business, the practical requirements are similar: know what data you collect and why, have a privacy policy that explains your practices, honor deletion requests, protect the data you hold, and notify people if their data is compromised.
A privacy policy is not a legal technicality. It is a public commitment to how you handle data. It should be accurate, understandable, and actually reflect your practices. A privacy policy that says you do not share data while your marketing tools send data to third parties creates legal liability.
Case Study
The forgotten database
Situation
A SaaS startup collected user data during a beta test, stored it in a development database, and forgot about it. Two years later, the development database was exposed in a misconfigured cloud storage bucket. The exposed data included names, emails, and hashed passwords of 3,000 beta users. Under GDPR, the company was required to notify all affected users within 72 hours.
Analysis
The data should have been deleted after the beta concluded, or at minimum, migrated to a secure, encrypted database. The company had no inventory of where personal data was stored, no retention policy, and no regular review of data stores. The forgotten database is a common pattern in growing companies.
Takeaway
Data you forget about is still data you are responsible for. Maintain an inventory of all data stores and delete data you no longer need.
Reflection Questions
- 1. Could you produce a complete list of everywhere your business stores customer personal information?
- 2. Does your privacy policy accurately reflect your actual data practices?
Key Takeaways
- ✓PII is any data that can identify a person — know what you collect and where it lives.
- ✓Encryption in transit (SSL) and at rest protect data from unauthorized access.
- ✓Privacy regulations require transparency, consent, deletion rights, and breach notification.
- ✓Data you forget about is still data you are responsible for — maintain inventories and retention policies.