Security safeguards personal information across collection, access, processing, storage, sharing, retention, and deletion. It combines organizational controls, legal obligations, and clear communication with the people whose data is handled. section 8.2.1 section 8.1.2
Effective security practice includes:
- Limit access to personal data and collect only what is needed for a specific purpose. section 8.2.1
- Retain data only as long as necessary, and support deletion requests and withdrawal where applicable. section 8.2.1 section 8.1.2
- Use anonymization, secure storage, and practical guardrails when handling personally identifiable information or protected health information. section 8.3 section 8.1.2
- Explain collection, use, storage, confidentiality measures, and opt-out choices in readable consent materials. section 8.1.2
Security responsibilities vary with jurisdiction and sector. Analysts may coordinate with IT, security, and legal teams, while smaller organizations may carry more responsibility for enabling individual rights. Sensitive categories include identifying, health, financial, demographic, and authentication data; compromised credentials can expose other data. section 8.2.1 section 8.3
Figure 8.3 Many types of sensitive information are governed by sector-specific laws, both in the US, as in the examples shown here, and around the world.
Use the sector-law overview to compare how different kinds of sensitive information receive specialized protection. section 8.2.1
