Privacy Management & Data Protection Topics
Privacy compliance, data protection frameworks, privacy incident investigation, and regulatory requirements. Covers privacy impact assessments, data classification, regulatory interpretation, and privacy-first operational practices.
Data Security, Privacy, and Governance
Data centric considerations covering classification, governance, protection, and quality. Topics include data classification and labeling, encryption strategies and key management for stored and in transit data, data residency and sovereignty requirements, privacy regulations and compliance, data lifecycle and retention policies, access controls and delegation, data governance frameworks, addressing shadow information technology and data mobility, and practical data quality concerns and how they interact with privacy and access controls.
Privacy Incident Response and Escalation
Assessment covers the end to end management of privacy incidents, including detection and escalation criteria, severity assessment and triage, containment and remediation steps, cross functional coordination with security legal and communications, regulatory and user notification obligations, escalation to leadership and board, post incident review, and continuous improvement. Candidates should describe playbooks and runbooks, decision frameworks for disclosure and notification, timelines and stakeholder communication strategies, coordination with third parties, and how to operationalize lessons learned into policies and controls.
Ethical Judgment and Confidentiality
Assesses ethical decision making and stewardship of sensitive or confidential information encountered on the job. Topics include identifying what information is private or sensitive (e.g. personnel records, customer data, financial or proprietary business information), applying confidentiality safeguards, balancing transparency with privacy and fairness, documenting decisions while protecting sensitive data, escalating to legal or senior leadership when appropriate, avoiding conflicts of interest, and recognizing and mitigating bias in judgment calls. Candidates should be able to describe concrete examples where they applied ethical judgment in ambiguous situations and explain their reasoning and the outcome.
Data Breach Investigation and Response
Covers the end to end handling of a data breach with emphasis on privacy, legal and regulatory obligations, and practical incident response skills. Topics include detection and triage, determining scope and impact such as affected systems, data types, number of individuals, and exposure duration, and preserving evidence while protecting privacy and legal privilege through proper chain of custody and log preservation. Candidates should be able to coordinate cross functional stakeholders including information technology, security, legal, privacy, communications, senior leadership, human resources, product teams, external forensic firms, and law enforcement when appropriate. The canonical skill set includes structuring an incident response workflow comprising initial investigation, containment, eradication and remediation, recovery and monitoring, root cause analysis, documentation, and post incident lessons learned. Practical knowledge of notification triggers and timelines under major privacy and health laws is required, for example the General Data Protection Regulation seventy two hour notification expectation, the California Consumer Privacy Act requirement to notify without undue delay, and breach assessment principles under the Health Insurance Portability and Accountability Act. Candidates should be able to recommend a breach notification strategy identifying who to notify and when, prepare regulator and customer communications, manage reputational and psychological impacts, and describe prevention measures such as data minimization, encryption, access controls, logging and monitoring, vulnerability management, and incident response testing.