Understanding Information And Data Security

Introduction

Information and Data are fundamental resources that support individuals, societies, governments, businesses, industries and economies. Almost every activity involves the creation, collection, processing, storage, communication or use of information and data. From personal communications and financial transactions to scientific research, industrial operations, public services and national infrastructure, the ability to manage and protect these resources is essential.

Digital transformation has significantly increased the volume, variety and velocity of data generated and exchanged across interconnected environments. Computers, mobile devices, applications, sensors, industrial systems, communication networks, cloud platforms and connected services continuously generate and process data. These resources support automation, analytics, artificial intelligence, decision-making, service delivery and business operations.

However, the growing dependence on information and data also introduces security challenges. Unauthorized access, data breaches, information disclosure, manipulation, loss, destruction and misuse can affect individuals, organizations, governments and critical infrastructure. The consequences may include financial losses, operational disruption, privacy violations, reputational damage, regulatory penalties and threats to public safety or national security.

Protecting these resources requires more than securing the systems and networks through which they are accessed. It requires an understanding of what data and information represent, how they are created and used, where they are stored, how they are exchanged, who owns or manages them, and what protection they require throughout their lifecycle.

Information Security and Data Security are closely related disciplines that address these requirements. Information Security protects information in all its forms, including digital, physical and verbal forms. Data Security focuses on protecting data against unauthorized access, alteration, disclosure, loss and destruction, particularly as it is collected, processed, stored and transmitted through information systems.

Data Governance complements these disciplines by establishing the policies, responsibilities, decision-making structures and management practices that determine how data is owned, classified, accessed, shared, retained and used.

Together, Information Security, Data Security and Data Governance establish the foundation for protecting information and data across personal, organizational, governmental, industrial and interconnected digital environments.

Understanding Data

Definition of Data

Data refers to recorded values, measurements, symbols and representations associated with entities, events, activities and conditions. It can describe people, objects, transactions, systems, processes, locations and other real-world or digital phenomena.

Data may exist as numbers, text, images, audio, video, measurements, sensor readings, transaction records, identifiers or other representations. It can be collected directly through observation or generated automatically by devices, applications, systems and processes.

For example, a temperature reading of 35°C, a bank transaction amount of $100 USD, a person’s age, a timestamp, a GPS coordinate and a sensor measurement are all examples of data.

Data does not necessarily communicate a complete meaning on its own. Its interpretation often depends on additional context, such as its source, time of collection, units of measurement, relationships with other values and the purpose for which it is used.

In computing environments, data is represented using digital encoding so that computers and other electronic systems can store, process and communicate it. However, data is not limited to digital environments. Handwritten measurements, printed records, physical registers and manually collected observations are also forms of data.

Characteristics of Data

Data has several characteristics that influence how it is collected, managed, processed and protected.

Volume

Volume refers to the quantity of data generated, collected, stored or processed. Data may range from a small number of records to extremely large datasets generated by interconnected systems, digital platforms, research activities and industrial sensors.

Variety

Variety refers to the different forms and formats in which data exists. It includes structured records, text documents, images, audio, video, sensor readings, transaction records and machine-generated logs.

Velocity

Velocity refers to the speed at which data is generated, collected, transmitted and processed. Real-time applications, financial systems, industrial control environments and connected devices may generate data continuously.

Veracity

Veracity concerns the accuracy, reliability, consistency and trustworthiness of data. Inaccurate, incomplete, outdated or manipulated data can lead to incorrect analysis and decisions.

Value

Value refers to the usefulness of data for a particular purpose. Data can support research, operational activities, service delivery, analytics, planning, decision-making and innovation.

These characteristics are often used to describe large-scale data environments, but they are also relevant to smaller datasets and individual data resources.

Types of Data

Data can be categorized according to its structure and the way it is organized.

Structured Data

Structured data is organized according to a predefined schema or format. It commonly uses rows, columns, fields and defined data types, making it suitable for querying, sorting, filtering and analysis.

Relational databases are a common example of systems used to manage structured data. A customer database, for example, may contain fields such as customer ID, name, address, date of birth and account number.

Structured data is generally easier to validate and process because its organization and field definitions are established in advance.

Semi-Structured Data

Semi-structured data does not follow the rigid tabular structure of relational databases but contains identifiable elements, attributes, tags or metadata that provide some level of organization.

Examples include JSON, XML, email messages and certain application logs. These formats allow information to be represented through nested structures, key-value pairs, metadata and other organizational elements.

Semi-structured data provides flexibility while retaining characteristics that support automated processing and interpretation.

Unstructured Data

Unstructured data does not follow a predefined tabular schema or consistent organizational model. It may contain text, images, audio, video and other complex content.

Examples include documents, photographs, scanned records, presentations, recordings, social media content and multimedia files.

Unstructured data often requires specialized processing techniques, metadata extraction, indexing, content analysis or machine learning to identify and interpret its contents.

Data Representation

Data representation describes how data is encoded or expressed so that it can be recorded, stored, processed, interpreted or communicated.

Binary and Digital Representation

Computers represent digital data using binary values, commonly expressed as 0s and 1s. These values correspond to electrical, magnetic, optical or other physical states within computing and storage systems.

Different combinations of binary values represent numbers, characters, images, audio, video and other forms of digital content.

For example, text characters may be encoded using standards such as ASCII or Unicode. Images may be represented through pixels and colour values, while audio can be represented through digital samples.

Binary representation provides the foundation for digital data processing and communication.

Data Formats

A data format defines how data is structured, encoded or organized for storage, processing and exchange.

Examples include:

• CSV and spreadsheet formats for tabular data.
• JSON and XML for structured or semi-structured data exchange.
• PDF and DOCX for documents.
• JPEG, PNG and TIFF for images.
• MP3 and WAV for audio.
• MP4 and AVI for video.

Data formats influence how systems interpret and process information. They may also affect compatibility, metadata preservation, interoperability and long-term accessibility.

Data Structures

A data structure is a method of organizing and storing data so that it can be accessed, modified and processed efficiently.

Common data structures include arrays, linked lists, stacks, queues, trees, graphs, hash tables and records.

Data structures are important in software development, databases, operating systems, algorithms and application processing. They determine how data elements are arranged and how relationships between them are represented.

For example, a tree structure can represent hierarchical relationships, while a graph can represent interconnected entities and their relationships.

Data Collection and Acquisition

Data collection refers to the process of gathering observations, measurements, records and other data from different sources. Data acquisition is the process through which data is captured or obtained, often through automated or technical mechanisms.

Data may be collected from:

• Individuals through forms, surveys, interviews and other interactions.
• Business applications and transaction systems.
• Websites, mobile applications and digital platforms.
• Sensors, monitoring devices and industrial equipment.
• Research instruments and scientific experiments.
• Public records, government databases and published datasets.
• Logs generated by computers, networks and security platforms.

The collection process may be manual, automated or a combination of both.

The quality and reliability of collected data depend on the source, collection method, accuracy of measurement, validation procedures and context in which it is obtained.

Data Processing and Analysis

Data processing refers to the activities performed to transform, organize, validate, combine or otherwise manipulate data for a particular purpose. Data analysis examines data to identify patterns, relationships, trends and useful findings.

Data processing may include data validation, cleaning, transformation, aggregation, sorting, filtering, computation and integration.

For example, transaction records collected from multiple payment systems may be consolidated, validated and processed to produce financial summaries. Network logs may be processed to identify communication patterns, unusual activities or potential security incidents.

Data analysis can involve statistical methods, queries, visualizations, analytical models and machine learning techniques.

Data Aggregation

Data aggregation is the process of combining multiple data records, values or datasets to produce a consolidated representation or summary.

Aggregation may involve calculating totals, averages, counts, minimum and maximum values, grouping records or combining data from different sources.

For example, individual sales transactions can be aggregated to calculate daily, monthly or annual revenue. Network traffic records can be aggregated to identify traffic volumes across different network segments.

Data aggregation is useful for reporting, analytics, research, operational monitoring and decision-making. However, combining datasets can also introduce security and privacy considerations.

A collection of individual records that appear harmless in isolation may reveal sensitive patterns when aggregated. Aggregated information may also become identifiable when combined with other datasets or when the underlying records are sufficiently detailed.

Consequently, aggregation must be considered not only as a processing activity but also in relation to data classification, access restrictions, privacy requirements and disclosure risks.

Data Inference

Data inference refers to the process of deriving conclusions, attributes, relationships or additional information from existing data.

An inference may be produced through statistical analysis, logical reasoning, correlation, pattern recognition, analytical models or machine learning.

For example, location records combined with timestamps may reveal a person’s daily movements. Purchase records may indicate preferences or behavioural patterns. Publicly available datasets may reveal sensitive characteristics when correlated with other sources.

Data inference can provide useful insights for research, fraud detection, risk analysis, service optimization and decision-making. However, it can also create privacy and security risks when sensitive attributes are derived from data that was not originally classified as sensitive.

Inference risks are particularly relevant when multiple datasets are combined or when analytical systems generate conclusions about individuals, groups, organizations or activities.

Data governance and data protection practices should therefore consider not only the sensitivity of the original data but also the sensitivity of information that can be inferred from it.

Data Quality and Integrity

Data quality refers to the degree to which data is suitable for its intended purpose. It is influenced by accuracy, completeness, consistency, validity, uniqueness, timeliness and reliability.

Poor data quality can result in incorrect reporting, unreliable analysis, operational errors and flawed decisions.

Data integrity refers to the preservation of data accuracy, consistency and trustworthiness throughout its lifecycle. It requires protection against unauthorized or unintended modification, corruption and destruction.

Data integrity can be supported through validation, access restrictions, transaction controls, checksums, cryptographic mechanisms, audit trails, backups and controlled change management.

Although data quality and data integrity are related, they are not identical. Data may be accurately preserved but still contain incorrect values from the time of collection. Similarly, data may be of high quality initially but lose integrity through unauthorized modification.

Data Lifecycle

The data lifecycle describes the stages through which data passes from its creation or collection to its eventual archival or disposal. It provides a structured view of how data is generated, managed, processed, stored, used, shared and eventually removed.

The lifecycle may vary depending on the type of data, its purpose, applicable legal requirements and the environment in which it is managed. However, the following phases represent common activities across different data management environments.

Data Creation and Collection

Data creation and collection represent the initial phase of the lifecycle, during which data is generated, captured or obtained from different sources. Data may be created through business transactions, individual activities, scientific experiments, digital applications, industrial sensors, connected devices and other processes. It may also be collected from external databases, public records, research sources and third-party providers.

The quality and reliability of data depend on the accuracy of its source, the collection method and the context in which it is obtained. Appropriate collection requirements should establish the purpose, source, scope and authorization for obtaining the data.

Data Validation and Organization

Once data is created or collected, it may undergo validation and organization to ensure that it is suitable for its intended purpose. Validation involves checking data for accuracy, completeness, consistency, validity and other quality requirements. Errors, duplicate records, missing values and inconsistencies may be identified and corrected.

Organization involves structuring and categorizing data using appropriate formats, schemas, metadata, identifiers and classification attributes. These activities make data easier to manage, retrieve, process and maintain throughout its lifecycle.

Data Processing and Transformation

Data processing and transformation involve modifying, converting, combining or manipulating data to support a particular purpose. Activities may include data cleaning, normalization, formatting, aggregation, computation, integration and analysis.

Data may be transformed into different formats or structures to support applications, reporting, analytics, research and operational activities. Processing may also involve combining data from multiple sources to produce consolidated datasets or derive additional attributes and relationships.

Data Storage and Maintenance

Data storage and maintenance involve preserving data in appropriate storage environments and ensuring that it remains accessible, accurate and protected throughout its required retention period.

Data may be stored in databases, file systems, data lakes, data warehouses, cloud storage platforms, application repositories and other storage environments. Maintenance activities may include updating records, managing metadata, monitoring storage integrity, applying access restrictions, performing backups and maintaining storage availability.

The storage environment and protection mechanisms should be appropriate to the data’s sensitivity, operational importance and applicable security requirements.

Data Usage and Sharing

Data usage involves accessing and applying data for authorized purposes such as business operations, service delivery, research, analytics, reporting and decision-making. Data may be used by individuals, applications, systems and other authorized entities according to defined access permissions and usage requirements.

Data sharing involves making data available to other individuals, systems, departments, organizations or external entities. Sharing may take place through APIs, file transfers, databases, cloud platforms, data exchange systems or other communication channels. Appropriate authorization, purpose restrictions, access controls and secure transfer mechanisms should be applied to prevent unauthorized disclosure or misuse.

Data Archiving and Retention

Data archiving and retention involve preserving data for defined periods based on operational, legal, regulatory, historical, research or other legitimate requirements. Data that is no longer required for routine processing may be transferred to archival storage while remaining available for authorized retrieval when necessary.

Archived data must continue to receive appropriate protection against unauthorized access, modification, loss and destruction. Retention requirements should establish how long data must be preserved, where it should be maintained and under what conditions it may be accessed or retrieved.

Data Disposal and Destruction

Data disposal and destruction represent the final phase of the lifecycle, during which data is securely eliminated when it is no longer required and applicable retention obligations have been satisfied.

Disposal methods depend on the storage medium and the sensitivity of the data. Digital data may require secure deletion, cryptographic erasure or storage media sanitization, while physical records may require shredding, pulping or other approved destruction methods.

The disposal process should also consider copies, replicas, backups, exported datasets and data maintained by third parties. Appropriate verification and documentation may be necessary to demonstrate that disposal has been completed in accordance with established requirements.

Understanding these lifecycle phases helps establish appropriate management and protection requirements at each stage. Data security should not be treated as a single activity performed during storage; it must be considered throughout the entire lifecycle, from creation and collection to final disposal.

Understanding Information

Definition of Information

Information refers to content derived from data, observations, knowledge or other sources that has been organized, structured, contextualized, interpreted or presented in a manner that communicates meaning and provides understanding about a particular subject, entity, event, activity or condition.

Information helps individuals, organizations, governments and systems understand situations, identify relationships, recognize patterns, evaluate circumstances and make informed decisions. It provides context and meaning to recorded observations and other content, making them useful for communication, analysis, knowledge development and decision-making.

Information can be derived from data through activities such as processing, aggregation, correlation, analysis and interpretation. For example, an individual temperature reading represents data, whereas a report showing temperature variations over several hours, comparing them against normal operating ranges and identifying abnormal conditions provides information about the operating state of a manufacturing process.

Similarly, individual financial transactions represent data. When these transactions are organized, categorized and interpreted in a financial statement, they communicate information about revenue, expenditure, profitability and overall financial performance.

However, information is not limited to processed data or automated systems. It can also originate from direct observations, human experiences, research findings, professional knowledge, verbal communication, physical records and other sources. For example, an engineer’s observation of unusual equipment behaviour can provide information about a potential operational problem, even before sensor readings are collected or analyzed.

Information can exist in physical, analog and digital forms. It may be represented through documents, reports, books, photographs, diagrams, audio recordings, videos, electronic records and other communication formats. In computing environments, information is represented and processed as digital data, enabling applications and systems to store, retrieve, manipulate and transmit it.

The meaning and usefulness of information depend on factors such as context, accuracy, relevance, completeness, reliability and timeliness. The same data or content may communicate different meanings depending on the circumstances in which it is interpreted and the knowledge of the recipient. Therefore, information is not simply a collection of recorded data; it is meaningful content that provides understanding and value within a particular context.

Characteristics of Information

Information has several characteristics that determine its usefulness and reliability.

Accuracy

Information should correctly represent the subject, event or condition it describes. Inaccurate information can lead to misunderstandings and incorrect decisions.

Relevance

Information should be appropriate to the purpose for which it is used. Information may be accurate but irrelevant to a particular decision or activity.

Completeness

Information should contain sufficient detail to support its intended purpose. Missing context or incomplete records may result in incorrect interpretations.

Timeliness

Information should be available when required and should reflect an appropriate point in time. Outdated information may no longer represent the actual condition.

Consistency

Information should be presented in a consistent manner across systems, reports and communication channels. Conflicting representations can reduce trust and create operational problems.

Reliability

Information should be obtained from trustworthy sources and produced through dependable processes.

Accessibility

Information should be available to authorized users in a usable form when required. Accessibility must be balanced with appropriate protection against unauthorized disclosure.

Types of Information

Information can be categorized according to its purpose, subject, content and intended use.

Personal Information

Personal information relates to an identified or identifiable individual. Examples include names, contact details, identification numbers, financial details and other personal attributes.

Financial Information

Financial information describes financial transactions, assets, liabilities, revenue, expenditure, investments and other financial activities.

Business and Operational Information

Business and operational information supports the management and operation of commercial and organizational activities. Examples include business plans, operational procedures, performance reports, customer records and supplier information.

Technical Information

Technical information describes the design, configuration, operation and maintenance of technologies, systems and infrastructure. Examples include architecture diagrams, system configurations, technical specifications and engineering documentation.

Government and Public Information

Government and public information relates to public administration, policies, services, public records, national statistics and other government activities. Some information is intended for public access, while other information requires restricted handling.

Scientific and Research Information

Scientific and research information includes experimental findings, research results, observations, datasets, technical publications and related documentation.

Security Information

Security information supports the protection and operation of security capabilities. Examples include security policies, incident reports, vulnerability assessments, threat intelligence reports, investigation records and security architecture documentation.

Forms of Information

Information can exist in different forms depending on how it is created, represented, communicated and stored.

Physical Information

Physical information exists in tangible forms that can be handled or viewed directly.

Examples include printed documents, paper records, books, registers, photographs, maps, engineering drawings and physical archives.

Physical information requires protection against unauthorized viewing, copying, modification, removal, loss and destruction.

Analog Information

Analog information is represented through continuously varying physical signals or values rather than discrete digital states.

Examples include traditional audio recordings, analog video signals, magnetic recordings and information represented through physical measurement instruments.

Analog information may require physical protection as well as safeguards for the equipment and media used to record or reproduce it.

Digital Information

Digital information is represented and processed through digital systems. It may include electronic documents, emails, databases, multimedia files, digital records, application outputs and reports.

Digital information is encoded as data so that computing systems can store, process and transmit it.

Digital information is particularly dependent on the availability and security of the systems, applications, storage platforms and communication networks through which it is accessed and managed.

Information Processing

Information processing involves activities through which information is created, organized, interpreted, analyzed, summarized and presented.

It may include collecting information from different sources, validating its accuracy, establishing context, identifying relationships, interpreting findings and preparing reports or other outputs.

For example, an organization may collect operational records from different systems, correlate the records and produce a report that explains service performance. A government may consolidate information from multiple departments to support policy decisions.

Information processing may be performed by individuals, manual processes, software applications, analytical platforms or automated systems.

Information Storage and Retrieval

Information storage refers to maintaining information in a form that allows it to be preserved and accessed when required. Information retrieval refers to locating and obtaining relevant information from storage systems or other sources.

Information may be stored in digital repositories, databases, document management platforms, content management systems, physical archives and other storage environments.

Effective storage and retrieval depend on organization, indexing, metadata, access permissions, retention requirements, storage integrity and availability.

For example, a document management system may organize policies, contracts and reports using document identifiers, categories, metadata and access permissions. A physical archive may use registers, file references and controlled access procedures.

Information Communication and Distribution

Information communication refers to the exchange of information between individuals, systems or entities. Distribution involves making information available to intended recipients through appropriate channels.

Information may be communicated through verbal discussions, meetings, printed documents, email, messaging platforms, websites, applications, reports and digital collaboration systems.

Communication and distribution must consider the intended audience, sensitivity of the information, authorization to disclose it and the security of the communication channel.

Information Lifecycle

The information lifecycle describes the stages through which information passes from its creation or acquisition to its eventual archival or disposal. It provides a structured understanding of how information is generated, organized, validated, stored, accessed, used, communicated, retained and securely disposed of.

The information lifecycle applies to information in physical, analog and digital forms, including documents, reports, records, communications, publications and other information resources. The lifecycle may vary depending on the nature of the information, its purpose, sensitivity, operational importance, applicable legal and regulatory requirements, and the environment in which it is managed.

The following phases represent common activities throughout the information lifecycle.

Information Creation and Acquisition

Information creation and acquisition represent the initial phase of the lifecycle, during which information is generated, developed, recorded or obtained from different sources. Information may be created through human observations, research activities, analysis, communication, operational processes, professional knowledge and decision-making. It may also be derived from data processing, interpretation and analysis.

Information acquisition involves obtaining existing information from internal or external sources, such as documents, reports, publications, government records, research institutions, business partners, digital platforms and other information repositories.

During this phase, the origin, purpose, accuracy, reliability and authenticity of information should be considered. Appropriate requirements should establish how information is created or acquired, who is responsible for it and whether any restrictions apply to its collection, use or disclosure.

Information Organization and Validation

Information organization and validation involve arranging, reviewing and verifying information to ensure that it is accurate, consistent, relevant and suitable for its intended purpose.

Organization may include categorizing information, assigning metadata, establishing document structures, applying classification labels, creating indexes and defining relationships between information resources. These activities make information easier to identify, retrieve, interpret and manage.

Validation involves verifying the accuracy, completeness, authenticity, consistency and reliability of information. This may include reviewing source credibility, confirming facts, checking document versions, identifying conflicting information and correcting inaccuracies.

Effective organization and validation help maintain information quality, reduce ambiguity and support reliable communication, analysis and decision-making.

Information Storage and Maintenance

Information storage and maintenance involve preserving information in appropriate environments and ensuring that it remains accessible, accurate, reliable and protected throughout its required lifecycle.

Information may be stored in digital repositories, document management systems, content management platforms, databases, file systems, cloud storage services, physical archives, printed records and other storage environments.

Maintenance activities may include updating information, managing document versions, maintaining metadata, reviewing classification, preserving information integrity, controlling access and ensuring that information remains usable.

Protection requirements should consider the information’s sensitivity, value, retention requirements and the potential consequences of unauthorized access, disclosure, modification, loss or destruction.

Information Access and Usage

Information access and usage involve retrieving, viewing, interpreting and applying information for authorized purposes. Information may be accessed by individuals, applications, systems, departments, organizations or other entities to support operations, communication, research, planning, analysis and decision-making.

Access should be governed by appropriate permissions, classification requirements, user responsibilities and the purpose for which the information is required. Sensitive information may require additional restrictions, authentication, authorization and monitoring.

Information usage may include reading documents, reviewing reports, analyzing findings, applying technical instructions, supporting operational activities and making decisions based on available information.

Appropriate handling practices should ensure that information is used accurately, responsibly and in accordance with established policies and applicable requirements.

Information Communication and Distribution

Information communication and distribution involve conveying or making information available to intended recipients through appropriate channels and formats.

Information may be communicated through verbal discussions, meetings, presentations, printed documents, reports, email, messaging systems, websites, collaboration platforms and other physical or digital communication methods.

Distribution may occur within an organization, between different organizations, across government departments, through public communication channels or between individuals and external entities.

Security considerations include verifying recipients, confirming authorization, applying classification and handling requirements, selecting appropriate communication channels and preventing unauthorized disclosure.

Information should be communicated in a manner that preserves its accuracy, integrity, meaning and intended context. Incomplete, misleading or improperly presented information may result in misunderstanding or incorrect decisions.

Information Retention and Archiving

Information retention and archiving involve preserving information for defined periods based on operational, legal, regulatory, contractual, historical, research or evidentiary requirements.

Retention establishes how long information should be maintained and under what conditions it remains accessible. Information may need to be retained to support ongoing operations, regulatory compliance, legal proceedings, audits, historical preservation or future reference.

Archiving involves transferring information that is no longer required for routine use into appropriate long-term storage or preservation environments. Archived information may include historical records, completed project documentation, financial statements, legal documents, research publications and government records.

Archived information must remain protected against unauthorized access, modification, loss and destruction. Preservation requirements should also consider authenticity, integrity, readability, retrieval and continued accessibility, particularly when information must be maintained for extended periods.

Information Disposal and Destruction

Information disposal and destruction represent the final phase of the lifecycle, during which information is securely eliminated when it is no longer required and applicable retention obligations have been satisfied.

Disposal methods depend on the form, storage medium, sensitivity and applicable handling requirements of the information. Digital information may require secure deletion, cryptographic erasure or storage media sanitization, while physical documents and records may require shredding, pulping or other approved destruction methods.

The disposal process should also consider duplicate documents, archived copies, temporary files, backup records, removable storage media and information maintained by external service providers or third parties.

Appropriate verification and documentation may be required to demonstrate that information has been disposed of in accordance with established retention, security and regulatory requirements.

Understanding the information lifecycle helps establish appropriate management, governance and security requirements at every stage. Information Security must extend beyond storage and access controls to include how information is created, validated, communicated, retained and ultimately disposed of, regardless of whether it exists in physical, analog or digital form.

Data vs. Information

Data and information are closely related concepts, but they serve different purposes. Understanding their relationship is essential for establishing appropriate security and management practices.

Fundamental Differences Between Data and Information

Data and information are closely related concepts, but they represent different aspects of how facts, observations and knowledge are captured, organized and used.

Data represents facts, observations, measurements, symbols or recorded values associated with entities, events, activities or conditions. It serves as an input for storage, processing, analysis and other activities. Data may exist in structured, semi-structured or unstructured forms and can be represented through numbers, text, images, audio, video and other formats.

Information refers to content derived from data, observations, knowledge or other sources that has been organized, structured, contextualized, interpreted or presented in a manner that communicates meaning and provides understanding. It helps individuals and systems understand situations, identify relationships, recognize patterns and make informed decisions. Information can originate from data processing, direct observations, research, experience, professional knowledge, communication and other sources.

The fundamental difference lies in how these resources are represented and used. Data provides the underlying facts or recorded elements, whereas information provides meaning and understanding by establishing context, relationships or interpretation.

For example, individual temperature readings collected from a manufacturing process represent data. When these readings are organized chronologically, compared against operating thresholds and interpreted to identify abnormal temperature variations, they provide information about the operating condition of the manufacturing process.

Similarly, individual financial transactions represent data. When they are organized and analyzed to produce a financial statement showing revenue, expenditure and profitability, they communicate information about financial performance.

However, the distinction is not absolute. Data does not always have to be raw, and information does not always have to be produced through automated processing. A processed dataset can still be treated as data for another analytical activity, while a report or document containing information can become an input for subsequent processing.

Comparison Aspect	Data	Information
Definition	Recorded values, measurements, symbols and representations associated with entities, events and conditions.	Content organized, structured, contextualized or interpreted to communicate meaning and provide understanding.
Primary Purpose	Serves as input for storage, processing, analysis and other activities.	Supports understanding, knowledge development, communication and decision-making.
Context	May exist without sufficient context to explain its significance.	Provides context and meaning to content.
Structure	Can be structured, semi-structured or unstructured.	Can be organized and presented in different forms and formats.
Processing	Can be collected, validated, transformed, aggregated and analyzed.	Can be interpreted, correlated, summarized and presented.
Examples	Temperature readings, transaction records, timestamps and sensor measurements.	Weather reports, financial statements, analytical reports and operational summaries.
Relationship	Can serve as an input for generating information.	Can become input for further processing and analysis.

Therefore, data and information should not be viewed as completely separate resources. They are interconnected, and their roles can change depending on the context, purpose and manner in which they are used.

Relationship Between Data and Information

Data and information are connected through a continuous relationship in which data can be used to produce information, and information can subsequently become an input for further processing.

How Data Becomes Information

Data becomes information when it is organized, contextualized, interpreted or presented in a manner that communicates meaning.

For example, individual sales transactions may initially be recorded as data. When these transactions are grouped by product, location and time period, they can produce information about sales performance.

The transformation may involve validation, aggregation, correlation, analysis, interpretation and presentation.

How Information Becomes Data for Further Processing

Information can also become data when it is captured or represented as input for another activity.

For example, a financial report may communicate information about an organization’s expenditure. The figures extracted from that report can then be used as data in a budgeting or forecasting process.

Similarly, a research report may contain conclusions that are later converted into structured records for further analysis.

This demonstrates that data and information are not permanently separate categories. Their roles can change depending on the context and purpose of use.

Context, Meaning and Interpretation

Context plays an important role in determining whether a particular representation is understood as data or information.

A numerical value may represent a measurement, but without knowing what was measured, when it was measured and which unit was used, its meaning may be unclear.

When context is added, the value becomes more useful and interpretable.

Interpretation also depends on the knowledge and perspective of the recipient. The same information may be relevant to one individual or system but have a different significance for another.

Storage of Data and Information

Data and information can be stored using many of the same technologies and repositories. Digital information is encoded as data for storage and processing. Therefore, separate storage technologies are not necessarily required for data and information.

Digital Storage Systems

Databases

Databases store organized collections of data that can be accessed, managed and queried. Relational databases organize data through tables and relationships, while NoSQL databases support different data models such as documents, key-value pairs, graphs and wide-column structures.

Databases can store transaction records, customer information, operational records and other data used to produce information.

Data Lakes

Data lakes are storage environments designed to hold large volumes of data in different formats, including structured, semi-structured and unstructured data.

They support data ingestion, exploration, analytics and processing. Data lakes may contain source data as well as transformed or curated datasets.

Data Warehouses

Data warehouses store integrated and structured data designed primarily for reporting, business intelligence and analytical workloads.

They commonly consolidate data from multiple sources to support consistent reporting and historical analysis.

Data Marts

Data marts are smaller, subject-oriented data repositories designed to support the analytical requirements of a particular business function, department or user group.

File Systems and File Storage

File systems organize and manage files on storage devices and operating systems. They can store documents, images, application files, reports, datasets and other digital content.

Object Storage

Object storage manages data as objects containing the content, metadata and a unique identifier. It is commonly used for large-scale storage of documents, backups, multimedia files, datasets and application content.

Document Management Systems

Document management systems support the storage, organization, retrieval, versioning and controlled access of electronic documents.

Content Management Systems

Content management systems manage digital content such as web pages, articles, media files and other published material.

Knowledge Management Systems

Knowledge management systems organize and make available knowledge resources such as procedures, guidance, technical documentation, lessons learned and institutional knowledge.

Physical Storage

Paper Records and Documents

Paper records may contain personal, financial, legal, operational and administrative information. They require appropriate physical storage, access restrictions and retention management.

Books, Manuals and Printed Reports

Printed publications, technical manuals, operational guides and reports preserve information in a physical form.

Physical Archives and Record Repositories

Archives and record repositories preserve historical, legal, administrative and other records. They require appropriate environmental conditions, indexing, access controls and preservation procedures.

Processing of Data and Information

Data processing and information processing are closely related. They may use the same systems and technologies, but the activities can have different objectives.

Data Processing

Data processing focuses on manipulating and transforming data to make it suitable for storage, analysis, integration or further use.

Data Collection and Acquisition

Data is obtained from relevant sources through manual or automated processes.

Data Validation and Cleaning

Data is checked for accuracy, completeness, consistency and validity. Errors, duplicates and inconsistencies may be corrected or removed.

Data Transformation

Data is converted into a required structure, format or representation. Transformation may include normalization, encoding, formatting and mapping.

Data Aggregation and Computation

Multiple records or values are combined, grouped or calculated to produce consolidated datasets and results.

Data Analysis

Data is examined to identify trends, relationships, anomalies, patterns and other useful findings.

Information Processing

Information processing focuses on organizing, interpreting and presenting content so that it communicates meaning and supports its intended purpose.

Organization and Structuring

Information is arranged into a logical format using categories, headings, classifications, metadata and relationships.

Contextualization and Interpretation

Information is placed within an appropriate context so that its significance can be understood.

Correlation and Analysis

Information from different sources may be compared or correlated to identify relationships, similarities, differences and implications.

Information Summarization and Presentation

Information is condensed and presented through reports, dashboards, visualizations, documents and other communication formats.

Information Interpretation for Decision-Making

Information is evaluated in relation to objectives, requirements, risks and available options to support decisions.

Transmission of Data and Information

Data and information can be transmitted through digital communication systems as well as physical and non-digital communication methods.

Digital Data and Information Transmission

Computer Networks and the Internet

Computer networks and the Internet enable digital data and information to be exchanged between devices, systems, applications and users.

Application Programming Interfaces

APIs provide defined interfaces through which applications exchange data and access services. They support system integration, automation and information exchange.

Email and Messaging Systems

Email and messaging platforms enable the exchange of text, documents, images, attachments and other digital content.

File Transfer and Sharing

File transfer systems and sharing platforms allow users and applications to exchange datasets, documents and other digital resources.

Wireless Communication

Wireless technologies such as Wi-Fi, Bluetooth, cellular networks and satellite communication enable data and information exchange without requiring a direct wired connection.

Physical and Non-Digital Information Communication

Printed Documents and Reports

Printed records, reports and publications communicate information through physical distribution.

Physical Distribution of Records

Information may be transferred through physical records, storage media, archives and other tangible materials.

Verbal Communication

Information can be communicated through conversations, meetings, presentations and telephone discussions.

Visual Communication

Maps, diagrams, charts, photographs, drawings and other visual representations communicate information through visual formats.

Key Differences in Storage, Processing and Transmission

Although data and information are conceptually different, they frequently use the same storage, processing and transmission technologies.

Aspect	Data	Information
Representation	Facts, values, observations and recorded elements.	Meaningful content derived from data or other sources.
Storage	Databases, datasets, files, data lakes and other repositories.	Documents, reports, knowledge systems, databases and other repositories.
Processing	Validation, transformation, aggregation and computation.	Organization, contextualization, interpretation and presentation.
Transmission	Network protocols, APIs, file transfer and other mechanisms.	Digital communication, documents, reports, verbal and visual communication.
Purpose	Serves as an input for processing, analysis or other activities.	Supports understanding, communication, knowledge and decision-making.

The important distinction is that data and information do not necessarily require separate infrastructure. The same database may store both individual transaction records and interpreted results. A network may transmit both raw data and meaningful reports. A document repository may contain datasets, policies, analysis and other information.

Consequently, security must address the content, its sensitivity, its purpose and its handling requirements rather than relying only on whether something is labelled data or information.

Understanding Information and Data Security

Definition of Information Security

Information Security refers to the discipline of protecting information against unauthorized access, use, disclosure, modification, disruption, loss or destruction.

It applies to information regardless of its form or medium. This includes digital information stored in databases and applications, physical information contained in printed records and documents, and information communicated verbally or visually.

Information Security establishes the policies, processes, practices and controls required to preserve the confidentiality, integrity and availability of information.

It also considers the authenticity, accountability, reliability and appropriate use of information.

Definition of Data Security

Data Security refers to the practices, technologies, policies and controls used to protect data against unauthorized access, disclosure, modification, loss, destruction and misuse.

It applies throughout the data lifecycle, including collection, processing, storage, transmission, sharing, archival and disposal.

Data Security includes controls such as access restrictions, encryption, data masking, tokenization, backup, integrity verification, monitoring and secure deletion.

It also considers the protection of data across databases, applications, endpoints, networks, cloud platforms, storage environments and other systems.

Information Security vs. Data Security

Information Security and Data Security have overlapping objectives, but their scope and emphasis differ.

Aspect	Information Security	Data Security
Primary focus	Protecting information in all forms.	Protecting data throughout its lifecycle.
Scope	Digital, physical, analog, verbal and visual information.	Data stored, processed, transmitted or otherwise managed through different environments.
Protection objectives	Confidentiality, integrity and availability of information.	Confidentiality, integrity and availability of data.
Typical assets	Documents, reports, records, communications, knowledge and digital content.	Databases, datasets, files, records, data stores and data streams.
Protection measures	Information handling, document protection, access restrictions and disclosure controls.	Encryption, database access controls, masking, tokenization, DLP and secure data transfer.
Governance	Information policies, information ownership and information handling requirements.	Data policies, data ownership, classification, access, usage and sharing requirements.

Information Security has a broader scope because information can exist outside digital data environments. Data Security concentrates on protecting data as it is represented, stored, processed, accessed and transmitted.

Relationship Between Information Security and Data Security

Information Security and Data Security are closely related and complementary disciplines that share the common objective of protecting information and data against unauthorized access, disclosure, modification, loss, destruction and misuse. Although their scope and areas of emphasis differ, both are essential for maintaining the confidentiality, integrity, availability, authenticity and reliability of information resources.

Information Security establishes the broader requirement to protect information regardless of its form, representation or medium. It encompasses digital information stored in databases, applications and electronic documents, as well as physical information maintained in printed records, books, reports and archives. It also extends to information communicated verbally, visually or through other non-digital methods. Its scope includes the policies, processes, practices and controls required to ensure that information is appropriately accessed, handled, communicated, stored, retained and protected.

Data Security focuses specifically on protecting data throughout its lifecycle, from creation and collection to processing, storage, usage, sharing, archival and disposal. It addresses the security requirements associated with data repositories, databases, applications, storage platforms, computing environments and communication channels. Its controls include data access restrictions, encryption, data masking, tokenization, integrity verification, backup, recovery, monitoring and secure deletion.

The relationship between these disciplines becomes clearer when considering how information is represented and managed across different environments. Digital information is encoded and stored as data within computing systems. Consequently, protecting digital information requires securing the underlying data, together with the systems and infrastructure used to process and manage it. However, information may also exist independently of digital systems, which means its protection requires additional measures beyond conventional data security controls.

For example, consider a confidential financial report containing revenue, expenditure, financial forecasts and other sensitive details. The printed report requires physical access restrictions, secure document handling, controlled distribution and appropriate storage. Its electronic version requires protection through document access permissions, encryption, endpoint security and secure communication channels. The underlying financial records stored in databases require database access controls, data integrity mechanisms, monitoring, backup and recovery. If the report is discussed during a meeting, confidentiality must also be maintained through appropriate communication and disclosure practices.

This example demonstrates that a single information resource may exist in multiple forms and pass through different environments. Information Security addresses the overall protection requirements, while Data Security provides specific safeguards for the data representations and resources involved.

Similarly, consider personal information maintained by a healthcare institution. Printed patient records require physical safeguards and controlled access. Electronic patient records require identity verification, authorization, encryption, audit logging and protection against unauthorized disclosure. Data extracted from these records for research or statistical analysis may require additional controls such as data minimization, de-identification, restricted access and secure sharing. The information must remain protected regardless of whether it is maintained as a physical record, processed electronically or communicated to an authorized recipient.

Information Security and Data Security also share important protection objectives. Both disciplines contribute to maintaining confidentiality by preventing unauthorized disclosure, integrity by protecting against unauthorized or unintended modification, and availability by ensuring that authorized users can access the required resources. They also support authenticity, accountability and appropriate usage through identity verification, access management, monitoring, audit trails and established handling requirements.

From a governance perspective, Information Security establishes the overall policies and requirements for protecting information assets. Data Security translates relevant requirements into specific practices and technical safeguards for protecting data. Data Governance complements both disciplines by establishing data ownership, stewardship, classification, quality, access, usage, sharing and retention requirements.

Therefore, Information Security provides the broader context for protecting information in all its forms, while Data Security addresses the specialized requirements for protecting data throughout its lifecycle. They should not be treated as competing or independent disciplines; instead, they must operate together to ensure that information and its underlying data remain protected across different forms, systems, environments and communication channels.

Objectives of Information and Data Security

The primary objectives are to protect information and data from unauthorized activities while ensuring that legitimate users can access and use them appropriately.

Prevent Unauthorized Access

Ensure that only authorized individuals, systems and processes can access information and data.

Prevent Unauthorized Disclosure

Protect sensitive information and data from being exposed to unauthorized recipients or entities.

Preserve Integrity

Protect information and data against unauthorized or unintended modification, corruption and destruction.

Ensure Availability

Maintain access to information and data when required by authorized users and services.

Maintain Authenticity

Ensure that information, data and their sources can be verified as genuine and trustworthy.

Support Accountability

Maintain records and evidence that allow relevant activities and actions to be attributed to responsible entities.

Enable Appropriate Use

Ensure that information and data are accessed, processed, shared and retained for authorized and legitimate purposes.

Importance of Information and Data Security

Information and data security are essential because these resources support personal activities, public services, business operations, economic activity and critical infrastructure.

Protection of Personal Privacy

Personal data and information may reveal identity, financial circumstances, location, behaviour, health-related details and other private attributes. Protecting these resources helps prevent unauthorized disclosure, identity misuse, profiling and other forms of harm.

Protection of Financial Resources

Financial records, payment data, banking information and transaction details require protection against theft, manipulation, fraud and unauthorized disclosure.

Continuity of Operations

Businesses, governments, industrial facilities and public services depend on accurate and accessible information. Loss or disruption can affect operations, service delivery and decision-making.

Protection of Intellectual Property

Research findings, designs, software, technical documentation, trade secrets and other intellectual assets may represent significant economic or strategic value.

Trust and Reputation

Individuals, customers, citizens, partners and other stakeholders expect information and data to be handled responsibly. Security failures can reduce confidence and damage relationships.

Legal and Regulatory Compliance

Applicable laws, regulations, contractual obligations and sector-specific requirements may establish conditions for collecting, processing, storing, sharing and protecting information and data.

Protection of Critical Infrastructure

Energy, transportation, healthcare, telecommunications, water, manufacturing and other critical services depend on information and data. Security incidents can have consequences beyond individual systems or organizations.

Scope of Information and Data Security

Information and Data Security applies across different entities, environments and activities.

Its scope includes:

• Individuals and personal computing environments.
• Businesses and commercial organizations.
• Government departments and public services.
• Financial institutions and payment ecosystems.
• Healthcare and research environments.
• Industrial systems and manufacturing facilities.
• Critical infrastructure and essential services.
• Educational institutions and knowledge repositories.
• Digital platforms, applications and interconnected services.

The required protection depends on the nature of the information or data, its sensitivity, the potential consequences of compromise, applicable obligations and the environment in which it is used.

Data-Centric Security

Data-Centric Security is an approach that places the protection of data at the centre of security design and implementation.

Traditional security approaches often emphasize protecting the infrastructure, networks, applications and endpoints through which data is accessed. Data-Centric Security complements these measures by focusing on the data itself, its sensitivity, its permitted use and the safeguards that should remain applicable as it moves between environments.

For example, a sensitive dataset may be stored in an internal database, exported to a cloud platform, processed by an application and shared with an authorized third party. A data-centric approach seeks to maintain appropriate protection and handling requirements across these different locations and activities.

This approach may involve:

• Identifying and classifying data according to sensitivity and business or operational requirements.
• Applying access restrictions based on identity, authorization and permitted purpose.
• Using encryption, tokenization, masking and other protection mechanisms.
• Monitoring access, usage, movement and disclosure.
• Maintaining data lineage and audit records where appropriate.
• Enforcing retention, sharing and disposal requirements.

Data-Centric Security does not replace infrastructure, network or application security. It complements them by ensuring that protection requirements follow the data across its lifecycle and different environments.

CIA Triad – Fundamental Principles of Data and Information Security

The CIA Triad represents three fundamental security objectives: Confidentiality, Integrity and Availability. These principles provide the foundation for evaluating security requirements and selecting appropriate controls.

Confidentiality

Confidentiality ensures that information and data are accessible only to authorized individuals, systems and entities.

It prevents unauthorized disclosure, viewing, copying, extraction and use.

Confidentiality is important for personal information, financial records, government information, business documents, intellectual property, security information and other sensitive resources.

Common confidentiality controls include:

• Authentication and authorization.
• Role-based and attribute-based access control.
• Encryption at rest and in transit.
• Data masking and tokenization.
• Physical access restrictions.
• Data Loss Prevention.
• Secure information handling and sharing procedures.

The level of confidentiality required depends on the sensitivity of the information or data and the consequences of unauthorized disclosure.

Integrity

Integrity ensures that information and data remain accurate, complete and protected against unauthorized or unintended modification.

It supports trust in the content, records and outputs used by individuals, applications and systems.

Integrity can be compromised through malicious modification, accidental changes, software errors, transmission failures, storage corruption or unauthorized manipulation.

Common integrity controls include:

• Data validation and input controls.
• Hashing and checksums.
• Digital signatures.
• Database integrity constraints.
• Audit trails and logging.
• Version control and change management.
• Access restrictions and separation of duties.
• Backup and recovery mechanisms.

Integrity is particularly important in financial transactions, healthcare records, industrial operations, scientific research and other environments where incorrect data can have significant consequences.

Availability

Availability ensures that information and data remain accessible to authorized users and systems when required.

Information may become unavailable because of hardware failures, software defects, cyberattacks, ransomware, network disruptions, natural disasters, human errors or other operational incidents.

Availability controls include:

• Data backup and recovery.
• Redundant storage and infrastructure.
• High-availability architectures.
• Disaster recovery arrangements.
• Business continuity planning.
• Capacity and performance management.
• Resilience testing.
• Protection against denial-of-service attacks.

Availability is not limited to digital systems. Physical records and other information resources must also remain accessible when required, subject to appropriate protection.

Security Principles for Data and Information

In addition to the CIA Triad, other security principles support the trustworthiness and appropriate use of information and data.

Authenticity

Authenticity establishes that information, data, identities and sources are genuine and can be verified.

It helps determine whether a message, document, transaction, record or communication originated from the claimed source and has not been falsely represented.

Authentication mechanisms, digital certificates, cryptographic signatures, trusted timestamps and source verification procedures can support authenticity.

Accountability

Accountability ensures that actions involving information and data can be attributed to responsible individuals, systems or entities.

It supports investigation, auditing, compliance and security monitoring.

Logging, audit trails, identity management, activity monitoring and documented responsibilities contribute to accountability.

Non-Repudiation

Non-repudiation provides evidence that a particular action, transaction or communication occurred and can be associated with its originator.

Digital signatures, trusted timestamps, transaction records and cryptographic evidence can support non-repudiation.

The strength of non-repudiation depends on the trustworthiness of the identity verification, key management, record preservation and supporting processes.

Reliability

Reliability refers to the ability of information and data resources and the processes that manage them to perform consistently and produce dependable results.

Reliable information supports accurate analysis, effective operations and sound decision-making.

Reliability is influenced by data quality, system integrity, operational controls, availability, source trustworthiness and effective management practices.

Information and Data Assets

Information and data assets are resources that have value and require appropriate management and protection.

Identifying these assets is an important step in understanding what must be protected, why protection is necessary and which controls are appropriate.

Understanding Information Assets

Information assets are information resources that have value to an individual, organization, government or other entity.

They may exist in physical, analog or digital forms.

Examples include:

• Policies, procedures and operational documents.
• Contracts, agreements and legal records.
• Financial statements and transaction reports.
• Personal and customer information.
• Technical documentation and engineering designs.
• Research findings and intellectual property.
• Security policies, incident reports and threat intelligence.
• Government records and public-service information.

An information asset may contain one or more data assets and may be managed through different systems, repositories or physical records.

Understanding Data Assets

Data assets are data resources that have value because of their use, ownership, operational importance, analytical potential or strategic significance.

Examples include:

• Customer and user datasets.
• Employee and workforce records.
• Financial and transaction datasets.
• Product and inventory data.
• Research and scientific datasets.
• Operational and industrial sensor data.
• Network and security telemetry.
• Geographic and location datasets.
• Application and system logs.

Data assets may be stored in databases, data lakes, data warehouses, files, object stores, applications and other repositories.

Types of Information and Data Assets

Information and data assets can be categorized according to their purpose, subject, sensitivity and operational importance.

Personal and Identity Assets

These include personal records, identity attributes, contact details, identification numbers and other information associated with individuals.

Financial Assets

These include transaction records, payment information, financial reports, accounting data and investment records.

Business and Operational Assets

These include operational records, customer information, supplier data, business plans, performance reports and process documentation.

Technical and Engineering Assets

These include system configurations, architecture documents, technical specifications, software development records and engineering datasets.

Research and Intellectual Property Assets

These include research data, experimental results, designs, proprietary methods, patents and other intellectual resources.

Security and Risk Assets

These include vulnerability information, security configurations, incident records, threat intelligence, risk assessments and security monitoring data.

Public and Government Assets

These include public records, government datasets, administrative information and other information maintained by public authorities.

Information and Data Asset Identification

Information and Data Asset Identification is the process of discovering, recording and understanding the information and data resources that require management and protection.

It involves identifying what information and data exist, where they are created or collected, where they are stored, how they are processed, who uses them and how they are shared.

Asset identification may involve:

• Reviewing applications, databases, repositories and storage platforms.
• Identifying physical records, documents and archives.
• Examining data flows between systems and entities.
• Reviewing information collection and processing activities.
• Identifying external data sources and third-party exchanges.
• Recording asset owners, custodians and responsible stakeholders.
• Identifying the purpose, sensitivity and operational importance of assets.

The results can be maintained in information asset registers, data inventories, data catalogues or other asset management repositories.

Asset identification should be an ongoing activity because information and data resources change as systems, services, processes and operational requirements evolve.

Information and Data Classification

Information and Data Classification is the process of categorizing information and data according to sensitivity, confidentiality requirements, business or operational impact, legal obligations and other protection requirements.

Classification helps determine how information and data should be accessed, stored, processed, transmitted, shared, retained and disposed of.

Classification schemes vary across organizations, governments, industries and jurisdictions. The following categories provide an illustrative model.

Public

Public information and data are intended for unrestricted disclosure or access.

Examples may include published reports, public notices, official publications, public datasets and publicly available website content.

Although public information does not require confidentiality protection against general disclosure, its integrity and availability may still need protection.

Internal

Internal information and data are intended for use within a defined organization, institution or community and are not generally intended for unrestricted public distribution.

Examples may include internal procedures, operational communications, non-public administrative records and routine internal documentation.

Unauthorized disclosure may create operational, reputational or other adverse consequences.

Confidential

Confidential information and data require stronger protection because unauthorized access or disclosure could cause significant harm.

Examples may include personal records, non-public financial information, business-sensitive information, customer records and internal security documentation.

Access should be restricted to authorized individuals and systems with a legitimate requirement.

Restricted

Restricted information and data require the highest level of protection within a given classification scheme.

Examples may include highly sensitive personal records, critical security information, sensitive government information, cryptographic key material and highly confidential intellectual property.

Access should be tightly controlled and subject to additional safeguards, monitoring and handling requirements.

Classification labels must be supported by clear handling rules. A label alone does not protect information or data; the associated controls must be implemented and enforced.

Information and Data Labelling and Marking

Information and Data Labelling and Marking refer to the processes of assigning and displaying identifiable labels, tags, metadata or visible markings on information and data assets to communicate their classification, sensitivity and associated handling requirements.

Labelling and marking follow classification and help individuals, applications and systems identify how information and data should be accessed, stored, processed, transmitted, shared and protected. While classification determines the appropriate security category, labelling and marking communicate that classification through identifiable attributes or representations.

Although the terms are closely related, they have different emphases. Labelling primarily involves assigning classification identifiers, tags or metadata to information and data assets. Marking involves displaying or applying those identifiers in a recognizable form so that their classification and handling requirements can be identified. Both can be applied to physical and digital environments.

Physical Information and Data Labelling and Marking

Physical labelling and marking involve assigning and displaying classification identifiers on printed documents, files, folders, storage media and other physical information resources. Examples include attaching labels to folders, printing CONFIDENTIAL or RESTRICTED markings on document covers, and displaying classification markings in document headers and footers. These identifiers help individuals recognize the sensitivity of physical resources and apply appropriate handling, storage, access and distribution restrictions.

Digital Information and Data Labelling and Marking

Digital labelling and marking involve assigning and displaying classification identifiers on electronic documents, emails, spreadsheets, presentations, images, datasets and other digital resources. Labelling may be implemented through sensitivity attributes, metadata fields, classification tags and digital properties. Marking may be displayed through document headers, footers, watermarks, email subject lines, document banners and other visible indicators. These mechanisms help users recognize the classification of digital resources and support consistent application of security requirements.

Metadata-Based Labelling

Metadata-based labelling associates classification attributes and handling information with data assets through metadata fields, tags or properties. These attributes may be maintained within databases, data catalogues, document management systems, cloud repositories and other data management platforms. Metadata-based labelling supports data discovery, classification management, access control, information handling and automated enforcement of protection requirements.

Automated Labelling and Marking

Automated labelling and marking use predefined rules, content inspection, pattern recognition and other technologies to identify sensitive information and assign or display appropriate classification identifiers. For example, a security platform may identify personal information or financial records and automatically apply a corresponding sensitivity label. Depending on the platform, the classification may also be displayed through visible markings such as document banners, headers, footers or watermarks.

Automated mechanisms can help maintain consistent classification across large information and data repositories, although human review may be required where classification is ambiguous or depends on business context.

Effective labelling and marking support consistent information handling, access control, data loss prevention, monitoring and regulatory compliance. Security platforms may use classification labels and associated metadata as inputs to enforce handling restrictions, encryption, access permissions, sharing controls and other data protection policies.

However, applying a label or marking does not itself protect information or data. The associated security policies, handling procedures and technical controls must be implemented and enforced to ensure that the assigned classification requirements are maintained throughout the information and data lifecycle.

Information Ownership and Custodianship

Information ownership and custodianship establish responsibility for managing and protecting information assets.

An information owner is generally responsible for determining how an information asset should be classified, accessed, used, shared and retained. A custodian may be responsible for maintaining the systems, repositories and physical environments in which the information is stored.

These responsibilities should be clearly assigned to avoid gaps in protection, unclear decision-making and conflicting handling practices.

Information and Data Security Across the Lifecycle

Information and data require protection throughout their lifecycle. Security controls should be applied from creation or collection through usage, sharing, retention and final disposal.

Creation and Collection

Creation and collection involve generating information or obtaining data from individuals, systems, devices, applications and other sources.

Security considerations include:

• Establishing a legitimate purpose for collecting information and data.
• Collecting only the information and data required for that purpose.
• Validating sources and collection methods.
• Applying appropriate consent or other lawful requirements where applicable.
• Defining initial classification and handling requirements.
• Restricting access during collection and initial processing.
• Protecting collection interfaces and input channels.

Improper collection can introduce inaccurate, excessive or unauthorized data into subsequent processes.

Storage and Retention

Storage and retention involve maintaining information and data for operational, legal, regulatory, historical or other legitimate purposes.

Security requirements include appropriate access restrictions, encryption, integrity protection, physical safeguards, backup and recovery, monitoring and retention management.

Storage environments may include databases, file systems, cloud storage, document repositories, physical archives and removable media.

Retention periods should be defined according to applicable requirements and the purpose for which the information or data is maintained.

Processing and Usage

Processing and usage involve accessing, transforming, analyzing, interpreting and applying information and data.

Security requirements include restricting access to authorized users and processes, protecting sensitive fields, validating processing activities, monitoring usage and preventing unauthorized extraction or manipulation.

Processing environments should also consider temporary files, cached information, exported datasets, application logs and intermediate processing results.

Sharing and Distribution

Sharing and distribution involve making information and data available to other individuals, systems, departments, organizations or external entities.

Security requirements include verifying recipients, confirming authorization, establishing permitted purposes, applying appropriate classification and handling rules, protecting transmission channels and recording relevant sharing activities.

Where applicable, sharing arrangements should also address consent, legal basis, data-sharing agreements, onward disclosure restrictions and cross-border transfer requirements.

Archiving and Disposal

Archiving involves preserving information and data for long-term retention, historical reference, legal obligations or other approved purposes.

Archived resources must remain protected against unauthorized access, modification, loss and destruction. Their accessibility and integrity should be maintained according to retention requirements.

Disposal involves securely eliminating information and data when they are no longer required or when applicable retention obligations have expired.

Disposal methods may include secure deletion, media sanitization, physical destruction of storage media, shredding of paper records and controlled destruction of other physical materials.

The disposal process should also consider copies, backups, replicas, exported files and third-party-held data where applicable.

Data Governance

Understanding Data Governance

Data Governance is the framework of policies, principles, roles, responsibilities, decision-making structures and processes used to manage data throughout its lifecycle.

It establishes how data is defined, owned, classified, accessed, used, shared, maintained, retained and disposed of.

Data Governance aims to ensure that data is managed consistently, responsibly and in accordance with its intended purpose, quality requirements, security needs, privacy obligations and applicable regulations.

It addresses both the management and appropriate use of data. This includes determining who has authority over data, who is responsible for maintaining its quality, who manages the technical environments in which it resides and under what conditions it may be accessed or shared.

Data Governance is relevant to businesses, governments, research institutions, public services, digital platforms and other environments that create, collect or manage data.

Data Governance Framework

A Data Governance Framework defines the structures and practices through which data governance is established and maintained.

It provides a common approach for assigning responsibilities, defining policies, establishing standards, managing data quality, controlling access and resolving data-related issues.

A framework may include:

Governance Structure

Defines the decision-making bodies, committees, responsible functions and reporting arrangements used to oversee data management.

Policies and Standards

Establishes the rules and requirements for data ownership, classification, quality, access, usage, sharing, retention and protection.

Roles and Responsibilities

Defines the responsibilities of data owners, data stewards, data custodians, data users and other relevant stakeholders.

Data Management Practices

Establishes how data is collected, documented, organized, maintained, integrated, shared and disposed of.

Monitoring and Compliance

Defines how adherence to data governance policies and requirements is monitored, reviewed and improved.

The framework should be proportionate to the volume, sensitivity, complexity and importance of the data being managed.

Data Policies

Data policies establish the principles, rules and requirements governing how data is managed and used.

They provide direction to individuals, departments, systems and external parties that create, access, process, store or share data.

Data policies should address the entire data lifecycle and establish expectations for ownership, classification, quality, access, usage, sharing, retention and disposal.

Common policy areas include:

Data Governance Policies

Define the overall governance principles, responsibilities, decision-making authority and management requirements for data.

Data Security Policies

Establish security requirements for protecting data against unauthorized access, disclosure, modification, loss and destruction.

Data Access and Usage Policies

Define who may access data, under what conditions, for which purposes and subject to which restrictions.

Data Sharing Policies

Establish requirements for sharing data internally and externally, including recipient authorization, permitted purposes, disclosure restrictions and relevant agreements.

Data Retention and Disposal Policies

Define retention periods, archival requirements and approved methods for securely disposing of data.

These policies may be supported by standards, procedures, guidelines and technical requirements that explain how the policies are implemented.

Data Ownership and Responsibilities

Data Governance requires clear assignment of responsibility for data resources. Different roles may be established to provide decision-making authority, operational oversight and technical protection.

The exact role names and responsibilities can vary across organizations and governance models. The following distinctions provide a common conceptual approach.

Data Owner

A Data Owner is the individual, function or designated authority accountable for a particular data domain or data asset.

The Data Owner establishes the requirements for how the data should be managed and used. This may include determining its classification, approving access, defining permitted purposes, establishing sharing conditions and setting retention expectations.

For example, a finance function may be assigned ownership of financial data, while a human resources function may be assigned ownership of employee data.

The Data Owner is generally responsible for ensuring that data-related decisions align with operational requirements, legal obligations and governance policies.

Data Steward

A Data Steward is responsible for the day-to-day governance and management of data within an assigned domain.

The role commonly focuses on data definitions, metadata, quality, consistency, documentation, classification practices and compliance with established governance requirements.

A Data Steward may coordinate data quality activities, maintain business definitions, document data lineage, identify inconsistencies and support the implementation of data governance policies.

The Data Steward helps translate governance requirements into consistent data management practices.

Data Custodian

A Data Custodian is responsible for the technical or operational management of data repositories and the environments in which data is stored, processed and maintained.

The role may be performed by IT, database administration, cloud operations, infrastructure teams or other technical functions.

Responsibilities may include implementing access controls, encryption, backup, recovery, storage management, monitoring, retention mechanisms and secure disposal.

The Data Custodian implements the technical safeguards required to protect data in accordance with the requirements established by the Data Owner and the organization’s governance and security policies.

Data User or Consumer

A Data User or Consumer is an individual, application, system or other authorized entity that accesses or uses data for an approved purpose.

Users are expected to comply with access restrictions, usage conditions, classification requirements, sharing rules and other applicable policies.

Their access should be limited to the data and operations required for their authorized responsibilities.

Data Classification and Handling

Data classification establishes the sensitivity and protection requirements associated with data assets.

Data Governance defines the classification scheme, the criteria for assigning classifications and the responsibilities for maintaining classification accuracy.

Data handling requirements translate classification decisions into practical rules.

For example, confidential data may require restricted access, encryption, controlled sharing and additional monitoring. Public data may be made available for broader distribution, while still requiring integrity and availability protection.

Handling requirements should address:

• Who can access the data.
• Which purposes are permitted.
• Where the data may be stored.
• How the data may be processed.
• Whether and how the data may be shared.
• Which security controls must be applied.
• How long the data may be retained.
• How the data must be disposed of.

Classification should be reviewed when the sensitivity, purpose, content or applicable requirements of a dataset change.

Data Access and Usage Governance

Data Access and Usage Governance defines the conditions under which data may be accessed and used.

It establishes the authority to approve access, the permitted purposes for which data may be used and the restrictions that apply to different users, systems and entities.

Access governance should consider the data owner’s requirements, data classification, user responsibilities, business or operational need, legal obligations and applicable privacy requirements.

For example, an individual may be authorized to view a customer record for service delivery but may not be authorized to export the entire customer dataset or use it for an unrelated purpose.

Data usage governance should therefore consider not only whether a user can access data but also what the user is permitted to do with it.

Data Sharing and Exchange Governance

Data Sharing and Exchange Governance establishes the rules and responsibilities for making data available to other users, systems, departments, organizations or external entities.

Data sharing may occur within a single organization, between separate organizations, across government departments, between research institutions or through public data platforms.

Governance should establish:

Sharing Authorization

Determine who has the authority to approve data sharing and whether the proposed recipient is permitted to receive the data.

Purpose and Usage Restrictions

Define the purpose for which the data may be used and restrict unrelated or unauthorized processing.

Data Minimization

Share only the data required for the approved purpose.

Recipient and Third-Party Requirements

Verify recipients and establish appropriate contractual, operational and security requirements where necessary.

Data Sharing Agreements

Where appropriate, establish agreements that define the data being shared, permitted purposes, responsibilities, security requirements, retention periods and restrictions on onward disclosure.

Secure Data Exchange

Require appropriate technical safeguards for transferring and receiving data, including encryption, authentication, access controls and monitoring.

Retention and Disposal

Define how long the recipient may retain the shared data and how it should be returned or securely disposed of when no longer required.

Regulatory and Privacy Requirements

Consider applicable privacy, data protection, confidentiality, cross-border transfer and sector-specific obligations.

Effective data sharing governance enables legitimate data exchange while reducing the risk of unauthorized disclosure, misuse and loss of control over shared data.

Data Privacy and Personal Data Protection

Understanding Data Privacy

Data Privacy refers to the principles, requirements and practices governing how personal data is collected, accessed, processed, used, shared, retained and disposed of. It focuses on ensuring that information relating to individuals is handled appropriately, transparently and in accordance with their rights, expectations and applicable legal requirements.

Data Privacy establishes the conditions under which personal data can be collected and processed, the purposes for which it may be used, the entities that may access it and the circumstances under which it may be disclosed to others. It also addresses individuals’ rights concerning their personal information and the responsibilities of entities that determine or perform personal data processing activities.

Personal data is generated and collected through numerous activities, including financial transactions, healthcare services, online interactions, digital communications, employment, education, government services and connected devices. These activities may involve collecting identity details, contact information, location records, financial information, behavioural attributes and other details associated with individuals.

Data Privacy aims to ensure that such information is not collected excessively, processed for unauthorized purposes, shared inappropriately or retained longer than necessary. It also establishes requirements for transparency, lawful processing, individual rights and responsible data management.

For example, an online service may collect a person’s name, email address, location and payment details to provide a particular service. Data Privacy requirements determine whether the collection is justified, how the information may be used, whether it can be shared with other entities, how long it can be retained and what rights the individual has over the information.

Data Privacy is relevant to individuals, businesses, governments, research institutions, healthcare providers, financial institutions and digital platforms. Any activity involving personal data may introduce privacy considerations, regardless of whether the data is maintained in physical records, electronic documents, databases or other environments.

Understanding Personal Data

Personal Data refers to any information relating to an identified or identifiable individual. An individual may be identified directly through a particular attribute, such as a name or identification number, or indirectly through a combination of attributes, records and other available information.

Personal data is not limited to information that explicitly identifies an individual. Information such as location history, device identifiers, online activity, transaction records and behavioural patterns may also constitute personal data when they can be associated with an identifiable person.

For example, a person’s name and passport number can directly identify that individual. However, a combination of location records, timestamps, device identifiers and activity patterns may also reveal the identity of an individual even when their name is not explicitly recorded.

Personal data may exist in structured, semi-structured and unstructured forms. It can be maintained in databases, spreadsheets, application records, documents, photographs, audio recordings, video footage, emails and other information resources.

The scope and definition of personal data vary across legal jurisdictions. However, the underlying principle is that information relating to an identified or identifiable individual requires appropriate consideration of privacy and data protection obligations.

Types of Personal Data

Personal data can be categorized according to the nature of the information, its sensitivity and the potential consequences of unauthorized access, disclosure or misuse.

Personally Identifiable Information (PII)

Personally Identifiable Information (PII) refers to information that can identify an individual directly or indirectly, either independently or when combined with other information.

The term PII is commonly used in certain regulatory and technical contexts, particularly in the United States. Other jurisdictions commonly use the broader term personal data or personal information.

Examples include:

• Full name, date of birth and residential address.
• Passport numbers, national identification numbers and other government-issued identifiers.
• Telephone numbers and email addresses.
• Financial account identifiers and payment information.
• Device identifiers and certain online identifiers.
• Location information and records that can be associated with an individual.

PII may be used for identity verification, service delivery, financial transactions, communication and other legitimate activities. However, unauthorized disclosure or misuse can expose individuals to identity theft, fraud, impersonation and other forms of harm.

Sensitive Personal Data

Sensitive Personal Data refers to personal information that requires additional protection because of its nature or the potential consequences of its misuse, disclosure or unauthorized processing.

Examples may include:

• Health and medical records.
• Biometric identifiers.
• Genetic information.
• Financial information.
• Religious or philosophical beliefs.
• Political opinions or affiliations.
• Sexual orientation and other intimate personal information.

The legal treatment of sensitive personal data varies across jurisdictions. Some legal frameworks establish specific categories of sensitive information and impose additional processing conditions, while others define particular protections through sector-specific or privacy-related requirements.

For example, medical records may require stronger access restrictions, confidentiality safeguards and additional legal conditions for processing because their disclosure can have significant consequences for an individual’s privacy and personal circumstances.

Special Categories of Personal Data

Certain privacy frameworks, particularly the General Data Protection Regulation (GDPR) of the European Union, establish specific categories of personal data that receive enhanced legal protection.

Under GDPR, special categories include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for uniquely identifying an individual, health data, and data concerning a person’s sex life or sexual orientation.

Processing these categories is subject to additional legal requirements and specific conditions. The classification of information as a special category depends on the applicable legal framework and cannot be generalized across all jurisdictions.

It is important to distinguish special categories of personal data under a particular regulation from the broader concept of sensitive personal data. Different jurisdictions may define sensitive information differently and impose different protection requirements.

Data Privacy vs. Data Security

Data Privacy and Data Security are closely related but address different aspects of personal data protection.

Data Privacy governs how personal data is collected, processed, accessed, used, shared and retained. It establishes whether particular processing activities are appropriate, justified and consistent with applicable privacy requirements.

Data Security focuses on protecting data against unauthorized access, disclosure, modification, loss, destruction and misuse. It establishes the technical and operational safeguards required to protect data throughout its lifecycle.

For example, a healthcare institution may be legally permitted to collect patient information to provide medical services. Data Privacy determines the purposes for which that information may be collected and processed, the conditions under which it may be shared and the rights available to the individual. Data Security establishes the safeguards used to protect medical records through access controls, encryption, monitoring, backups and other mechanisms.

Aspect	Data Privacy	Data Security
Primary focus	Appropriate collection, processing and use of personal data.	Protection of data against security threats and unauthorized activities.
Main concern	Whether personal data is being handled appropriately and lawfully.	Whether data is adequately protected against compromise.
Scope	Personal data and the rights and interests of individuals.	Data across different categories, systems and environments.
Key requirements	Transparency, purpose limitation, data minimization and individual rights.	Confidentiality, integrity, availability, authentication and access control.
Typical practices	Consent management, privacy notices, processing restrictions and privacy impact assessments.	Encryption, access controls, monitoring, backup and Data Loss Prevention.
Governance	Privacy policies and data protection obligations.	Information Security and Data Security policies and controls.

Data Privacy and Data Security must operate together. Personal data can be securely stored and protected but still be processed for an unauthorized purpose. Similarly, personal data may be collected and processed for a legitimate purpose but remain vulnerable because of inadequate security controls.

Therefore, effective personal data protection requires both appropriate privacy governance and effective security safeguards.

Data Privacy Principles

Data Privacy Principles establish the fundamental requirements for collecting, processing, using, sharing and retaining personal data. They guide how personal data should be handled and provide a foundation for privacy policies, procedures and regulatory compliance.

Different jurisdictions and regulatory frameworks establish their own principles and terminology. The following principles reflect widely recognized privacy concepts, including those established under GDPR.

Lawfulness, Fairness and Transparency

Lawfulness, fairness and transparency require personal data to be processed on a valid legal basis, in a fair manner and with appropriate transparency.

Lawfulness means that personal data processing must satisfy an applicable legal basis or authorization. Fairness requires that processing should not create unjustified harm, discrimination or unexpected consequences for individuals. Transparency requires that individuals receive appropriate information about how their personal data is collected and used.

For example, a digital service collecting personal information should explain what information it collects, why it is required, how it will be used and whether it will be shared with other entities.

Purpose Limitation

Purpose Limitation requires personal data to be collected for specified, explicit and legitimate purposes and not subsequently processed in ways that are incompatible with those purposes.

An entity collecting personal data should establish and communicate the intended purpose before or at the time of collection, subject to applicable legal requirements.

For example, a healthcare provider collecting patient information to deliver medical treatment should not automatically use that information for unrelated marketing activities without satisfying the applicable legal and privacy requirements.

Purpose limitation helps prevent personal data from being reused for unauthorized, unrelated or unexpected activities.

Data Minimization

Data Minimization requires personal data collection and processing to be limited to what is necessary for the specified purpose.

Entities should avoid collecting excessive personal information or retaining unnecessary attributes merely because they may be useful in the future.

For example, an online service requiring an email address to create an account may not need to collect a person’s residential address, government identification number or unrelated personal details.

Data minimization reduces the amount of personal information exposed to unauthorized access, disclosure and misuse. It also limits the potential impact of a data breach.

Accuracy

The Accuracy Principle requires personal data to be accurate and, where necessary, kept up to date.

Inaccurate or outdated personal data can lead to incorrect decisions, service failures, administrative errors and other adverse consequences for individuals.

Entities processing personal data should establish appropriate procedures to verify, correct and update records when required.

For example, incorrect contact information in a healthcare or financial record may prevent important communications from reaching the intended individual.

Storage Limitation

Storage Limitation requires personal data to be retained only for as long as necessary to fulfil the purposes for which it was collected or processed, subject to applicable legal and regulatory retention requirements.

Entities should establish appropriate retention periods and review whether personal data continues to be required.

When personal data is no longer necessary and no legal or other valid retention requirement applies, it should be securely deleted, anonymized or otherwise disposed of using appropriate methods.

This principle helps reduce unnecessary data accumulation and limits the exposure associated with retaining personal data indefinitely.

Integrity and Confidentiality

Integrity and Confidentiality require personal data to be protected against unauthorized or unlawful processing, accidental loss, destruction and damage through appropriate technical and organizational measures.

This principle connects Data Privacy directly with Information Security and Data Security.

Protection mechanisms may include encryption, access restrictions, authentication, authorization, monitoring, secure storage, backup and recovery, and physical security measures.

The safeguards should be proportionate to the sensitivity of personal data, the potential risks to individuals and the nature of the processing activities.

Accountability

Accountability requires entities responsible for personal data processing to demonstrate that they comply with applicable data protection requirements.

It involves establishing appropriate governance structures, policies, procedures, records and oversight mechanisms to ensure that privacy obligations are implemented and maintained.

Accountability may include maintaining records of processing activities, conducting privacy assessments, documenting legal bases, managing consent where applicable, monitoring compliance and demonstrating that appropriate protection measures are in place.

It is not sufficient to establish privacy policies; the responsible entity should also be able to demonstrate how those policies are implemented.

Consent and Lawful Processing

Consent and Lawful Processing establish the conditions under which personal data may be collected and processed.

Consent is one possible legal basis for processing personal data, but it is not the only basis recognized by privacy regulations. Depending on the applicable legal framework and circumstances, processing may also be permitted on other grounds, such as contractual necessity, legal obligations, protection of vital interests, public tasks or legitimate interests.

Under GDPR, for example, consent must be freely given, specific, informed and unambiguous. Where required, it must be possible for individuals to withdraw consent, subject to the applicable legal conditions.

Organizations and other data-processing entities should identify the appropriate legal basis before collecting or processing personal data. They should also ensure that individuals receive appropriate information about the processing activity.

Consent should not be treated as a universal authorization to collect or use personal data for any purpose. Its validity and applicability depend on the processing activity, the legal framework and the circumstances in which it is obtained.

Personal Data Collection and Processing

Personal Data Collection and Processing involve obtaining, recording, organizing, storing, accessing, analyzing, modifying, using and otherwise handling information relating to individuals.

These activities may take place through websites, mobile applications, digital platforms, healthcare systems, financial services, government services, employment processes, connected devices and other environments.

Privacy requirements should be considered throughout the processing lifecycle rather than only at the point of collection.

Important considerations include:

Collection Transparency

Individuals should receive appropriate information about the personal data being collected, the purpose of collection, the responsible entity and other relevant processing details.

Purpose and Legal Basis

Each processing activity should have a defined purpose and an appropriate legal basis where required.

Data Minimization

Only personal data necessary for the specified purpose should be collected and processed.

Processing Restrictions

Access and processing activities should be restricted to authorized individuals and systems operating within approved purposes.

Accuracy and Maintenance

Personal data should be maintained accurately and corrected when necessary.

Security and Confidentiality

Appropriate safeguards should protect personal data against unauthorized access, disclosure, modification, loss and destruction.

Retention and Disposal

Personal data should be retained according to established requirements and securely disposed of when it is no longer required and no valid retention obligation applies.

Personal Data Sharing and Disclosure

Personal Data Sharing and Disclosure involve making personal data available to other individuals, organizations, government authorities, service providers or external entities.

Sharing may take place within an organization, between separate organizations, through third-party service providers, across digital platforms or between entities located in different jurisdictions.

Personal data sharing should be governed by an appropriate legal basis, defined purposes, authorization requirements and applicable privacy obligations.

Important considerations include:

Purpose of Sharing

Personal data should be shared only for specified and legitimate purposes consistent with the applicable legal requirements.

Recipient Authorization

The receiving entity should have an appropriate basis and authorization to receive and process the personal data.

Data Minimization

Only the personal data necessary for the intended purpose should be disclosed.

Third-Party Responsibilities

Where service providers or other external entities process personal data on behalf of another entity, appropriate contractual and operational requirements should establish their responsibilities and permitted activities.

Secure Data Transfer

Personal data should be protected during transmission through appropriate mechanisms such as encryption, authentication and secure communication channels.

Further Disclosure Restrictions

Conditions should be established regarding whether recipients may disclose the personal data to additional parties or use it for other purposes.

International Data Transfers

Transfers of personal data across national borders may be subject to specific legal requirements, transfer mechanisms and safeguards depending on the jurisdictions involved.

Effective data sharing governance helps ensure that personal data remains subject to appropriate privacy and security protections even when it moves beyond its original collection environment.

Data Anonymization and Pseudonymization

Data Anonymization and Pseudonymization are techniques used to reduce privacy risks associated with processing personal data. Both techniques modify how personal data is represented, but they provide different levels of protection and have different legal implications.

Data Anonymization

Data Anonymization refers to transforming personal data so that individuals can no longer be identified, directly or indirectly, using reasonably available means.

The objective is to prevent the data from being associated with an identifiable individual while retaining sufficient utility for purposes such as research, statistical analysis and reporting.

Techniques may include removing direct identifiers, generalizing attributes, suppressing identifying values, aggregating records and applying statistical privacy techniques.

For example, a healthcare dataset may contain patient names, identification numbers, exact addresses and medical details. An anonymization process may remove direct identifiers and generalize certain attributes to reduce the possibility of identifying individuals.

However, removing names and identification numbers alone does not necessarily produce anonymized data. Other attributes may still allow individuals to be identified, particularly when datasets are combined with external information.

Under GDPR, information that has been genuinely anonymized so that an individual is no longer identifiable falls outside the definition of personal data. The effectiveness of anonymization must therefore be assessed in the context of reasonably available identification methods.

Data Pseudonymization

Data Pseudonymization refers to processing personal data in such a way that it can no longer be attributed to a specific individual without the use of additional information.

It typically involves replacing direct identifiers with artificial identifiers, tokens or pseudonyms while maintaining a separate mechanism through which the original identity can be recovered by authorized entities.

For example, a patient record may replace a person’s name and identification number with a randomly generated patient identifier. The mapping between the original identity and the pseudonymous identifier is maintained separately with appropriate protection.

Pseudonymization reduces the direct exposure of personal identifiers and can support research, analytics, testing and other data-processing activities.

However, pseudonymized data remains personal data when an individual can be re-identified using additional information. It therefore continues to require appropriate privacy and security protections.

Difference Between Anonymization and Pseudonymization

Aspect	Data Anonymization	Data Pseudonymization
Identification	Aims to prevent identification of individuals.	Replaces direct identifiers while allowing re-identification using additional information.
Re-identification	Individuals should not be reasonably identifiable.	Re-identification remains possible through separately maintained information.
Additional information	Should not enable identification using reasonably available means.	A separate mapping or additional information is maintained.
Privacy protection	Reduces identification risk through irreversible or effectively irreversible transformation.	Reduces direct identification risk but does not eliminate it.
Regulatory status under GDPR	Genuinely anonymized information is not personal data.	Pseudonymized information remains personal data.
Typical applications	Public statistics, anonymized research and aggregate reporting.	Healthcare research, analytics, testing and controlled data processing.

Anonymization and pseudonymization are useful privacy-enhancing techniques, but their effectiveness depends on the data, transformation methods, available external information and the potential for re-identification.

Data Subject Rights

Data Subject Rights refer to the rights granted to individuals concerning the collection, processing, access, use and protection of their personal data under applicable privacy and data protection laws.

These rights allow individuals to understand how their personal information is being handled and, where applicable, request access, correction, deletion, restriction or other actions relating to their data.

The specific rights and conditions vary across jurisdictions. GDPR provides a well-established example of a framework that grants several rights to individuals.

Right to Be Informed

Individuals have the right to receive information about how their personal data is collected and processed.

This may include the identity of the responsible entity, the purposes of processing, the legal basis, categories of personal data, recipients, retention periods and available rights.

Right of Access

Individuals may request confirmation of whether their personal data is being processed and obtain access to the relevant personal data, together with specified information about its processing.

This enables individuals to understand what information is held about them and how it is being used.

Right to Rectification

Individuals may request correction of inaccurate personal data and, where appropriate, completion of incomplete information.

This helps maintain accurate records and reduces the risk of incorrect decisions or adverse consequences resulting from inaccurate information.

Right to Erasure

The Right to Erasure, also known as the Right to Be Forgotten under GDPR, allows individuals to request deletion of personal data in specified circumstances.

However, this right is not absolute. Legal obligations, public interest, freedom of expression and other recognized grounds may justify continued retention or processing.

Right to Restrict Processing

Individuals may request restriction of personal data processing in certain circumstances, such as when the accuracy of data is disputed or processing is contested.

Restriction generally limits how the data may be used while the relevant issue is being addressed.

Right to Data Portability

Where applicable, individuals may receive personal data they have provided in a structured, commonly used and machine-readable format and may transmit it to another entity.

This right supports the movement of personal data between certain services and organizations under defined conditions.

Right to Object

Individuals may object to certain personal data processing activities, particularly where processing is based on legitimate interests or the performance of a task in the public interest.

Specific rules apply to objections involving direct marketing and other processing activities.

Rights Related to Automated Decision-Making

Certain privacy frameworks provide protections against decisions based solely on automated processing, including profiling, where those decisions produce legal or similarly significant effects.

Depending on the applicable framework and circumstances, individuals may have rights to obtain human intervention, express their views or contest the decision.

Privacy Impact Assessment

A Privacy Impact Assessment (PIA) is a structured process used to identify, evaluate and address privacy risks associated with the collection, processing, use, sharing and retention of personal data.

It helps determine how a proposed system, application, service, process or project may affect individuals’ privacy and what measures should be implemented to reduce potential harm.

Privacy assessments are particularly important when processing involves large volumes of personal data, sensitive information, systematic monitoring, profiling, new technologies or activities that may create significant risks to individuals.

Under GDPR, a Data Protection Impact Assessment (DPIA) is specifically required for processing activities likely to result in a high risk to the rights and freedoms of individuals.

A typical privacy assessment involves the following activities:

Identification of Processing Activities

Identify the personal data being collected, its sources, the purposes of processing, the individuals affected and the entities involved.

Assessment of Privacy Risks

Evaluate potential risks such as unauthorized disclosure, excessive collection, inappropriate usage, identity exposure, profiling, discrimination and unauthorized retention.

Evaluation of Legal and Privacy Requirements

Determine whether the processing has an appropriate legal basis and complies with applicable privacy principles, regulations and individual rights.

Identification of Protection Measures

Identify measures such as data minimization, access restrictions, encryption, anonymization, pseudonymization, retention controls and secure data sharing.

Documentation and Review

Document the assessment, decisions, identified risks and mitigation measures. Review the assessment when processing activities, systems or associated risks change.

Privacy Impact Assessments help integrate privacy considerations into the planning and implementation of systems, services and data-processing activities rather than addressing privacy risks only after deployment.

Privacy by Design and Privacy by Default

Privacy by Design and Privacy by Default are approaches that integrate privacy requirements into the design, development, configuration and operation of systems, services and data-processing activities.

They aim to ensure that privacy is considered from the beginning of a project and maintained throughout its lifecycle rather than being treated as an additional control introduced after implementation.

Privacy by Design

Privacy by Design involves incorporating privacy requirements into the architecture, design, development and operation of systems and processes.

It requires privacy considerations to influence decisions concerning data collection, processing, storage, access, sharing and retention.

For example, an application should be designed to collect only the personal data necessary for its intended functionality, provide appropriate access restrictions, protect sensitive information and support individual privacy rights.

Privacy by Design may involve:

• Incorporating data minimization into application architecture.
• Applying encryption and access controls.
• Providing transparency about personal data processing.
• Supporting consent and preference management where applicable.
• Designing secure data sharing mechanisms.
• Establishing retention and deletion capabilities.

Privacy by Default

Privacy by Default ensures that systems and services are configured to provide an appropriate level of privacy protection without requiring individuals to make additional configuration changes.

It means that only the personal data necessary for each specific purpose should be processed by default, with appropriate restrictions on collection, access, storage duration and accessibility.

For example, a social platform should not automatically make an individual’s personal profile publicly accessible if the intended privacy setting requires restricted access. Similarly, an application should not enable unnecessary personal data collection or sharing by default.

Privacy by Default therefore focuses on the initial configuration and operational settings of systems and services to ensure that privacy requirements are enforced unless an appropriate and lawful reason supports a different configuration.

Personal Data Protection Regulations

Personal Data Protection Regulations establish legal requirements governing the collection, processing, storage, sharing, transfer and protection of personal data.

These regulations define the responsibilities of entities processing personal data, the rights of individuals, the conditions for lawful processing and the consequences of non-compliance.

Requirements vary across jurisdictions, and entities processing personal data may need to consider multiple regulatory frameworks depending on where individuals are located, where processing takes place and which legal obligations apply.

Important examples include:

General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is a European Union regulation that establishes requirements for the processing of personal data and the protection of individuals’ rights.

It defines data protection principles, lawful bases for processing, data subject rights, controller and processor responsibilities, international transfer requirements and obligations relating to personal data breaches.

GDPR also establishes specific requirements for Data Protection Impact Assessments, Data Protection Officers in applicable circumstances and the implementation of appropriate technical and organizational safeguards.

Its territorial scope can extend beyond the European Union in circumstances defined by the regulation.

Digital Personal Data Protection Act (DPDPA), 2023 – India

The Digital Personal Data Protection Act, 2023 establishes India’s legal framework for processing digital personal data. It applies to digital personal data processed within India and, subject to the conditions specified in the Act, processing outside India in connection with offering goods or services to individuals in India.

It establishes obligations for Data Fiduciaries, rights and duties for Data Principals, requirements for consent and certain permitted grounds for processing, and provisions concerning personal data breaches, children’s personal data and Significant Data Fiduciaries. The Act also establishes the Data Protection Board of India.

The Digital Personal Data Protection Rules, 2025 provide detailed implementation requirements. The Act and Rules follow a phased commencement schedule, with most substantive compliance obligations scheduled to take effect on 13 May 2027. Consent Manager provisions are scheduled to take effect on 13 November 2026.

California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)

The California Consumer Privacy Act establishes privacy rights and obligations concerning the personal information of California residents, with amendments introduced through the California Privacy Rights Act.

It provides qualifying consumers with rights relating to access, correction, deletion and certain disclosures and uses of personal information. It also establishes obligations for covered businesses concerning transparency, consumer requests, data handling and other privacy requirements.

The framework includes additional provisions relating to sensitive personal information and certain processing activities.

Health Insurance Portability and Accountability Act (HIPAA) – United States

The Health Insurance Portability and Accountability Act (HIPAA) establishes requirements for protecting certain health information in the United States.

Its Privacy Rule governs the permitted uses and disclosures of protected health information by covered entities and business associates, while its Security Rule establishes safeguards for electronic protected health information.

HIPAA is particularly relevant to healthcare providers, health plans, healthcare clearinghouses and applicable business associates.

Personal Information Protection and Electronic Documents Act (PIPEDA) – Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) establishes requirements for handling personal information in certain commercial activities in Canada.

It addresses consent, accountability, access, accuracy, safeguards, openness and other privacy principles governing personal information.

Its application must be considered alongside applicable provincial privacy legislation and other relevant Canadian requirements.

These regulations demonstrate that personal data protection is governed through different legal approaches across jurisdictions. Compliance requires understanding the applicable regulatory scope, processing activities, individual rights and responsibilities of the entities involved.

Information and Data Protection Controls

Information and Data Protection Controls are the policies, procedures, technologies and mechanisms used to protect information and data against security threats and unauthorized activities.

The controls should be selected according to the sensitivity of the assets, the risks involved, the operating environment and the requirements established through governance.

Information Access and Handling Controls

Information Access and Handling Controls ensure that information is accessed, viewed, used, copied, stored and communicated only in accordance with authorized requirements.

These controls may include:

• User authentication and authorization.
• Role-based access restrictions.
• Physical access controls.
• Document handling procedures.
• Secure printing and copying.
• Restrictions on removable media.
• Secure communication practices.
• Information handling labels and markings.

These measures are particularly important for physical documents, confidential communications, sensitive reports and other information that may exist outside digital systems.

Data Access Control

Data Access Control restricts access to data according to defined identities, permissions, roles, attributes and security policies.

It ensures that users and systems can access only the data and operations for which they are authorized.

Common access control models include:

Discretionary Access Control (DAC)

DAC allows the owner or controller of a resource to determine which users may access it and what permissions they receive.

Mandatory Access Control (MAC)

MAC enforces access decisions according to centrally defined security policies and classification labels. Users cannot freely override the established restrictions.

Role-Based Access Control (RBAC)

RBAC assigns permissions to roles, and users receive access through their assigned roles.

Attribute-Based Access Control (ABAC)

ABAC evaluates attributes associated with users, resources, actions and environmental conditions to determine whether access should be permitted.

Effective data access control should follow least privilege, separation of duties and appropriate authorization requirements.

Data Authorization and Permissions

Data authorization determines which operations an authenticated user or system is permitted to perform on a particular data resource.

Permissions may include viewing, creating, modifying, deleting, exporting, sharing or administering data.

Authorization should be based on the user’s responsibilities, approved purpose, data sensitivity and relevant policies.

For example, a user may be allowed to view a financial record without having permission to modify or delete it. A reporting application may be permitted to read selected database fields without receiving unrestricted access to the underlying database.

Access permissions should be reviewed periodically and adjusted when roles, responsibilities or operational requirements change.

Data Protection Through Encryption and Cryptographic Controls

Encryption transforms readable data into an encoded form so that it cannot be understood without the appropriate cryptographic key.

It helps protect data confidentiality when stored or transmitted through potentially exposed environments.

Encryption at Rest

Protects data stored in databases, file systems, storage platforms, endpoints, backups and removable media.

Encryption in Transit

Protects data while it is transmitted across networks and communication channels.

Protection of Data in Use

Specialized techniques, such as confidential computing and certain forms of protected computation, can help protect data while it is being processed.

Cryptographic protection also supports integrity and authenticity through mechanisms such as hashing, message authentication codes and digital signatures.

Effective cryptographic security depends on suitable algorithms, secure implementation, key generation, key storage, key distribution, rotation and lifecycle management.

Document and Records Protection

Document and Records Protection focuses on securing physical and digital documents, records and other information-bearing materials.

Controls may include access restrictions, document classification, secure storage, version control, digital rights management, secure printing, physical safeguards and controlled distribution.

Records may also require protection against unauthorized modification or destruction to preserve their authenticity, integrity and evidentiary value.

Data Loss Prevention (DLP)

Data Loss Prevention refers to technologies and practices designed to detect and prevent unauthorized disclosure, transfer or removal of sensitive data.

DLP solutions can monitor data movement across endpoints, networks, email systems, cloud applications and other communication channels.

They may use content inspection, classification labels, pattern matching, contextual analysis and policy enforcement to identify sensitive data.

Depending on the configuration, DLP controls may alert, block, quarantine or require additional authorization for particular activities.

DLP can help address accidental exposure, unauthorized copying, data exfiltration and policy violations. However, it should operate as part of a broader data protection strategy rather than as a standalone security measure.

Information Disclosure Prevention

Information Disclosure Prevention focuses on preventing sensitive information from being exposed to unauthorized individuals or entities.

It includes technical and procedural safeguards that reduce the risk of accidental or intentional disclosure.

Examples include restricting access to sensitive documents, reviewing recipients before sending information, applying data masking, controlling publication and enforcing secure communication procedures.

Disclosure prevention should also consider information that may be inferred from aggregated datasets, metadata, system outputs and publicly available sources.

Data Backup and Recovery

Data Backup and Recovery protects data against loss or unavailability caused by hardware failures, software defects, accidental deletion, cyberattacks and other incidents.

Backups should be created according to defined recovery requirements and protected against unauthorized access, modification and destruction.

Important practices include:

• Defining backup frequency and retention.
• Maintaining appropriate backup copies.
• Protecting backup repositories.
• Restricting administrative access.
• Testing restoration procedures.
• Maintaining recovery documentation.
• Protecting backups against ransomware and destructive attacks.

Backup arrangements should be aligned with business continuity and disaster recovery requirements.

Information Retention and Secure Disposal

Information Retention and Secure Disposal ensures that information and data are preserved for the required period and securely eliminated when they are no longer needed.

Retention requirements may arise from operational needs, legal obligations, regulations, contractual commitments, historical requirements and evidentiary considerations.

Secure disposal methods should be appropriate to the storage medium and sensitivity of the information.

Digital disposal may involve secure deletion, cryptographic erasure or media sanitization. Physical disposal may involve shredding, pulping or destruction of storage media.

Disposal processes should consider copies, replicas, backup environments and information held by third parties.

Information and Data Security Across Environments

Information and data are created, processed, stored and transmitted across different computing and operational environments. Each environment introduces specific security considerations.

Personal Computing and Mobile Devices

Personal computers, laptops, smartphones and tablets store and process information and data used for communication, financial activities, work, education and personal services.

These devices may contain sensitive documents, credentials, personal records, application data and locally stored files.

Security measures include device encryption, screen locks, strong authentication, secure configuration, endpoint protection, application controls, regular updates and remote management where appropriate.

Users should also be aware of risks associated with public networks, untrusted applications, removable media, unauthorized sharing and device loss or theft.

Servers and Data Centers

Servers and data centers host applications, databases, file repositories, storage systems and other services that manage significant volumes of information and data.

Security requirements include physical access restrictions, server hardening, identity and access management, encryption, monitoring, backup, vulnerability management and infrastructure resilience.

Data center environments must also consider environmental controls, power availability, equipment protection and secure handling of storage media.

Databases and Applications

Databases and applications are major environments for creating, processing and managing data.

Security measures include database access controls, secure application design, input validation, encryption, database activity monitoring, secure configuration, patch management and protection against application vulnerabilities.

Applications should enforce authorization at appropriate levels and avoid exposing sensitive data through error messages, logs, APIs or insecure interfaces.

Networks and Communications

Networks enable information and data to move between devices, applications, systems and external entities.

Security measures include network segmentation, secure communication protocols, encryption, access control, monitoring, secure remote access and protection against interception and unauthorized traffic.

Network security controls should be designed to protect data while it moves between different environments and trust boundaries.

Cloud Environments

Cloud platforms provide computing, storage, database, application and other services through shared or dedicated infrastructure.

Information and data may be distributed across cloud services, regions, accounts, applications and third-party platforms.

Security considerations include cloud identity and access management, encryption, key management, configuration management, data classification, logging, backup, data residency and secure sharing.

Responsibility for protection is distributed between cloud service providers and customers according to the service model and contractual arrangements.

Organizations and other cloud users must understand their responsibilities for the data they store and process, including access management, configuration and appropriate usage.

Industrial and Critical Infrastructure

Industrial and critical infrastructure environments use information and data to monitor, control and operate physical processes and essential services.

Examples include energy, water, manufacturing, transportation, healthcare and telecommunications environments.

These environments may involve operational technology, industrial control systems, sensors, supervisory systems and specialized engineering platforms.

Security measures must consider confidentiality and integrity alongside operational availability, safety and reliability.

Controls may include network segmentation, controlled engineering access, secure configuration, monitoring, backup of critical configurations and protection of operational records.

Security decisions should account for the potential consequences of disrupting physical processes or essential services.

Information and Data Security Threats

Information and data may be exposed to threats arising from malicious activities, human error, technical failures, environmental events and weaknesses in management practices.

Unauthorized Access

Unauthorized access occurs when an individual, application or system accesses information or data without appropriate permission.

It may result from stolen credentials, weak authentication, misconfigured permissions, exploited vulnerabilities, compromised accounts or excessive privileges.

Unauthorized access can lead to information disclosure, data theft, manipulation and other security incidents.

Information Disclosure

Information disclosure occurs when information is made available to individuals or entities that are not authorized to receive it.

It may result from accidental sharing, insecure communication, misconfigured storage, compromised systems, inappropriate access permissions or deliberate disclosure.

Disclosure can affect personal privacy, business confidentiality, government interests and other sensitive activities.

Data Leakage and Exfiltration

Data leakage refers to the unauthorized or unintended exposure of data. Data exfiltration refers to the unauthorized transfer or removal of data from an environment.

Exfiltration may occur through compromised accounts, malware, malicious insiders, insecure applications, unauthorized cloud storage, email attachments or other transfer mechanisms.

Data leakage can be accidental or intentional, while exfiltration commonly involves data being transferred out of a controlled environment.

Information and Data Manipulation

Manipulation involves unauthorized or unintended changes to information and data.

It may include modifying financial records, altering system configurations, changing transaction details, manipulating research results or tampering with operational information.

Manipulation can undermine integrity, create incorrect decisions, conceal malicious activity and disrupt operations.

Information and Data Destruction

Destruction involves the unauthorized or unintended removal, deletion or physical damage of information and data.

It may result from ransomware, destructive malware, malicious actions, accidental deletion, hardware failure, physical damage or environmental events.

Destruction can affect operational continuity, legal records, historical information and the availability of essential services.

Insider Threats

Insider threats arise from individuals who have authorized access to systems, information or data but misuse that access or unintentionally expose resources.

Insider threats may involve employees, contractors, service providers, administrators or other trusted users.

Activities may include unauthorized copying, disclosure, manipulation, theft or destruction of information and data.

Insider risk management requires appropriate access controls, monitoring, separation of duties, awareness, governance and incident response.

Accidental Information Exposure

Accidental exposure occurs when information or data is unintentionally made available to unauthorized recipients or environments.

Examples include sending documents to incorrect recipients, publishing sensitive information, misconfiguring cloud storage, losing devices, exposing records through insecure applications or disposing of documents improperly.

Awareness, secure handling procedures, technical controls and verification processes can reduce these risks.

Information and Data Security Governance

Information and Data Security Governance establishes the oversight, accountability and management practices required to ensure that information and data are protected in accordance with defined security objectives.

It provides the governance foundation for security policies, risk management, responsibilities, compliance and control effectiveness.

Information Security Policies

Information Security Policies define the principles and requirements for protecting information across its different forms and environments.

They establish expectations for access, classification, handling, disclosure, storage, communication, retention and disposal.

Policies should be supported by standards, procedures and guidelines that explain how requirements are implemented.

Data Security Policies

Data Security Policies establish requirements for protecting data against unauthorized access, disclosure, modification, loss and destruction.

They may address encryption, access control, database security, data transfer, backup, monitoring, secure storage and disposal.

Data Security Policies should align with Data Governance requirements and the broader Information Security framework.

Roles and Responsibilities

Information and Data Security requires clearly defined responsibilities across governance, management, technical operations and data usage.

Relevant responsibilities may include:

• Security leadership responsible for establishing security direction and oversight.
• Information and Data Owners responsible for defining protection and usage requirements.
• Data Stewards responsible for data quality, definitions and governance practices.
• Data Custodians responsible for implementing technical safeguards and maintaining data environments.
• IT and security teams responsible for operating and monitoring security controls.
• Data users responsible for complying with access, handling and usage requirements.

Responsibilities may be distributed across different functions depending on the size, structure and operating model of the entity.

Information and Data Security Risk Management

Information and Data Security Risk Management identifies, assesses, treats and monitors risks that may affect the confidentiality, integrity and availability of information and data.

Risk assessment should consider the value and sensitivity of assets, potential threats, vulnerabilities, exposure, existing safeguards and the consequences of compromise.

Risk treatment may involve implementing additional controls, reducing exposure, changing processes, transferring certain risks or accepting risks within approved limits.

Risk management should consider the complete lifecycle and all relevant environments, including physical records, endpoints, applications, networks, cloud platforms and third-party services.

Information Protection and Privacy Regulations

Information and data may be subject to legal, regulatory, contractual and sector-specific requirements.

These requirements can govern how information is collected, processed, stored, accessed, disclosed, transferred, retained and disposed of.

Privacy and data protection regulations may impose additional obligations relating to personal data, lawful processing, consent or other legal bases, individual rights, breach notification, data minimization and international transfers.

Requirements differ across jurisdictions and sectors. Applicable obligations should therefore be identified and incorporated into governance policies, risk management practices and technical controls.

Information and Data Security Frameworks and Standards

Frameworks and standards provide structured guidance for establishing, implementing, maintaining and improving information and data security practices.

They support consistent security governance, risk management, control selection and assurance.

ISO/IEC 27001

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS).

It provides a risk-based management framework for protecting information assets and managing information security risks.

The standard addresses organizational, people, physical and technological security controls through its management system requirements and Annex A control reference set.

ISO/IEC 27002

ISO/IEC 27002 provides guidance on information security controls.

It supports the selection and implementation of controls for managing information security risks and is commonly used alongside ISO/IEC 27001.

Its control guidance covers areas such as access control, asset management, information handling, cryptography, operations security, communications security, supplier relationships and incident management.

ISO/IEC 27701:2025

ISO/IEC 27701:2025 specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS).

The standard provides a structured approach to managing privacy responsibilities associated with the processing of Personally Identifiable Information (PII). It applies to organizations acting as PII controllers and PII processors and addresses their responsibilities for protecting personal information throughout its processing lifecycle.

ISO/IEC 27701:2025 is a standalone management system standard that can be implemented independently or aligned and integrated with other management systems, including ISO/IEC 27001. It supports organizations in managing privacy risks, establishing appropriate controls and demonstrating accountability for PII processing.

NIST Cybersecurity Framework

The NIST Cybersecurity Framework provides a risk-based structure for managing cybersecurity risks.

Its core functions are Govern, Identify, Protect, Detect, Respond and Recover.

The framework supports the identification of assets, understanding of cybersecurity risks, implementation of protective measures, detection of incidents, response activities and recovery.

It can be applied across different sectors and organizational environments.

NIST SP 800-53

NIST SP 800-53 provides a catalogue of security and privacy controls for information systems and organizations.

It includes controls covering access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, system protection and other security and privacy areas.

It provides a detailed control reference for establishing and assessing security and privacy safeguards.

References

Online Sources

Online Sources

International Organization for Standardization (ISO) – ISO/IEC 27001:2022 – Information Security Management Systems
Defines requirements for establishing and maintaining an Information Security Management System (ISMS).

National Institute of Standards and Technology (NIST) – SP 800-53: Security and Privacy Controls
Provides a comprehensive catalogue of security and privacy controls for protecting information systems and data.

National Institute of Standards and Technology (NIST) – Privacy Framework
Provides a risk-based framework for identifying and managing privacy risks associated with personal data processing.

European Union – General Data Protection Regulation (GDPR)
Establishes requirements for personal data processing and protection, including individual rights and organizational responsibilities.

Ministry of Electronics and Information Technology (MeitY), Government of India – Digital Personal Data Protection Act, 2023
Provides India’s legislative framework for the processing and protection of digital personal data.

Books

Principles of Information Security
Michael E. Whitman and Herbert J. Mattord
Cengage Learning, 7th Edition, 2022

The Basics of Information Security
Jason Andress
Syngress, 2nd Edition, 2014

Computer and Information Security Handbook
John R. Vacca (Ed.)
Morgan Kaufmann, 3rd Edition, 2017

Information Security Management Handbook
Harold F. Tipton and Micki Krause (Eds.)
CRC Press, 6th Edition, Multi-Volume Collection, 2007–2012

Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World
Bruce Schneier
W. W. Norton & Company, 2015