Before you use this reference
This page is a lookup, not a tutorial — and not legal advice. The explanations live in Data Governance Fundamentals, Access Control Models, PII Classification and Sensitivity, Encryption at Rest and in Transit, Data Lineage and Cataloging, Anonymization and Pseudonymization, and The GDPR Mental Model.
Access control models#
RBAC: permissions attached to roles, users assigned to roles -> simple to audit ("who has role X"), can suffer role explosion
ABAC: permissions computed from user/resource/environment attributes -> flexible, harder to audit at a glanceBoth should be bounded by the principle of least privilege — the minimum access a role or rule genuinely needs, not the most convenient broad grant.
Classification tiers#
Public no restrictionInternal employees onlyConfidential restricted to specific roles (e.g. PII)Restricted highest sensitivity, strict audit trailClassify combinations, not just single columns — quasi-identifiers (gender + birth date + postal code) can re-identify someone with no single field looking sensitive alone.
Encryption#
| Threat | Protection | Typical mechanism |
|---|---|---|
| Stolen disk/backup | At rest | Symmetric-key encryption |
| Intercepted network traffic | In transit | TLS (hybrid: asymmetric handshake, symmetric bulk transfer) |
Encryption does not replace access control — an authorized process still sees plaintext once it legitimately decrypts data.
Lineage and cataloging#
Lineage: tracks where data originated and every place it flowed toCatalog: a searchable inventory of tables/columns, classification, owner, and lineage — makes lineage actually queryableClassification does not automatically propagate through a join — lineage is what connects a derived table back to its classified source.
Anonymization vs. pseudonymization#
| Reversible? | Still "personal data" under GDPR? | |
|---|---|---|
| Pseudonymization | Yes, with the separate mapping | Yes |
| Anonymization | No, by design | No |
Hashing a small/guessable input space (phone number, email) is NOTsafe anonymization — the input space can be enumerated and matched.GDPR principles as engineering discipline#
Data minimization: don't collect what you don't need — cheaper than protecting it laterPurpose limitation: data has a stated reason, not just a schemaStorage limitation: retention ends; define and automate itRight to erasure: requires lineage — you can't delete what you can't findFurther reading#
- Data governance and Access control — the two general disciplines this page summarizes.
- General Data Protection Regulation — full legal text — the actual regulation behind the principles above.
- K-anonymity — the formal model behind the classification and anonymization sections.
- Transport Layer Security — the protocol implementing the in-transit encryption row above.