What you'll learn
- Classify before you protect
- Data Loss Prevention
- Encryption and key management
- Privacy law essentials
Lessons
1Classify before you protect
Typical levels: Public, Internal, Confidential, Restricted. Each level sets rules for storage, sharing, encryption and retention. Label at creation (Microsoft Purview sensitivity labels, Google DLP) so controls follow the data.
2Data Loss Prevention
DLP inspects data at rest, in motion and in use for patterns such as card numbers, Aadhaar or PAN, then blocks, encrypts or alerts. Start in audit mode, tune false positives, then enforce on the highest-risk channels (email, cloud uploads, USB).
3Encryption and key management
Encrypt at rest (disk, database TDE, storage service encryption) and in transit (TLS 1.2+). Who controls the keys matters: provider-managed, customer-managed (CMK in Key Vault/KMS) or hold-your-own-key in an HSM. Rotate keys, separate key admins from data admins, and log key use.
4Privacy law essentials
- GDPR: lawful basis, data subject rights, DPIAs, 72-hour breach notification, fines up to 4% of global turnover.
- India DPDP Act 2023: consent and legitimate uses, Data Fiduciary duties, Data Principal rights, Significant Data Fiduciaries, penalties up to ₹250 crore; DPDP Rules 2025 phase in obligations.
- Privacy by design: data minimisation, purpose limitation, retention limits, pseudonymisation.
Hands-on lab: Build a data inventory
- List 8 types of personal data a small company holds (employee records, customer emails, payment data…).
- For each: where it's stored, who can access it, classification level and retention period.
- Mark which items need consent or another lawful basis.
- Identify one item you could stop collecting entirely.
- Draft a one-paragraph breach response for the most sensitive item.
Outcome: A starter Record of Processing Activities (RoPA).
Practice questions
GDPR breach notification to the regulator is due within…
Answer: 72 hours. Without undue delay and where feasible within 72 hours.
Under India's DPDP Act, the organisation deciding purpose and means is the…
Answer: Data Fiduciary. Equivalent to a GDPR controller.
Customer-managed keys mainly give you…
Answer: Control over key lifecycle and access. You can rotate, revoke and audit.
The full graded assessment (5 questions, pass mark 70%) is in the platform.
Key terms
- Data classification
- Labelling data by sensitivity to drive protection rules.
- DLP
- Data Loss Prevention: detects and blocks sensitive data leaving approved channels.
- Pseudonymisation
- Replacing identifiers so data can't be attributed without extra information.
- DPIA
- Data Protection Impact Assessment for high-risk processing.
- Data Fiduciary
- DPDP Act term for the entity deciding purpose and means of processing.
- Data minimisation
- Collecting only the personal data that's necessary.
- Tokenization
- Replacing sensitive data (e.g. card numbers) with non-sensitive tokens.
See the full cyber security glossary →
Official references
Related courses
Security Foundations & GRC
CIA triad, risk management, frameworks and the controls that hold a security program together.
Security Architecture & Zero Trust
Designing secure systems: trust boundaries, zero trust architecture, reference models and design reviews.