Data privacy is the set of rules and practices governing how personal data is collected, used, shared and deleted, and what rights people have over it. Security protects data from the wrong people. Privacy also asks whether you should hold the data at all, and what you may do with it.
How is privacy different from security?
You can have strong security and weak privacy. A company can lock a database perfectly and still collect far more than it needs, use it for something customers never agreed to, and keep it for ten years. Security is about confidentiality, integrity and availability. Privacy adds purpose, fairness, transparency and individual control.
NIST describes its Privacy Framework as a voluntary tool to help organizations identify and manage privacy risk while building products and services that protect individuals' privacy. It treats privacy as enterprise risk management, the same way you treat security.
What are the core principles?
Article 5 of the GDPR is the clearest short list. Personal data shall be:
- processed lawfully, fairly and transparently
- collected for specified, explicit and legitimate purposes and not used in incompatible ways (purpose limitation)
- adequate, relevant and limited to what is necessary (data minimisation)
- accurate and kept up to date
- kept identifiable for no longer than necessary (storage limitation)
- processed securely, protected against unauthorised processing and accidental loss (integrity and confidentiality)
The same article adds accountability: the controller is responsible for these principles and must be able to demonstrate compliance. Many national laws share these ideas even if the wording differs. Which law applies to you depends on where your users live and what you do, so ask counsel.
What does it look like in a real product? A constructed example
A fitness app collects name, email, date of birth, precise location and heart rate. A privacy review asks one question per field: what is this for?
Email is needed to sign in. Heart rate is the product. Date of birth is used only to show an age bracket, so the app stores the bracket and drops the birth date, which is minimisation. Precise location was added for a feature nobody uses, so the team removes it. Logs keep the user's data for 30 days and the account's data until deletion, with a deletion job that actually runs, which is storage limitation. The privacy notice is updated to match what the app really does.
None of that required new security tools. It required decisions.
Where do teams slip?
- Collecting data "in case it is useful later".
- Copying production data into test environments, analytics tools and spreadsheets, so deletion requests miss most of the copies.
- Sharing data with vendors without knowing what they do with it.
- Writing a policy that describes intentions, not practice.
- Forgetting that logs, backups and support tickets also contain personal data.
What about sensitive data and special rules?
Some categories of personal data carry stricter rules in many laws: health, children's data, biometrics, precise location and financial information. If you handle any of them, find out which rules apply before you design the feature, not after. Cross-border transfers, sale or sharing of data for advertising and automated decision making are other areas where rules differ by country and state. A one-page table of data categories, the lawful basis or permission you rely on and the countries involved keeps these questions visible.
How to check or apply this
- Build a data map: what personal data you hold, where it lives, why you hold it, who can see it and where it flows.
- For each data field, write the purpose. If you cannot, stop collecting it.
- Set retention periods and automate deletion, including backups on a defined schedule.
- List your vendors that touch personal data and check what contracts and settings govern them.
- Create a process to handle requests from people to access, correct or delete their data, and time it.
- Review privacy when you design features, not after launch.
- Keep records that show you did these things, because accountability means being able to prove it.
Quick check
Is data privacy just encryption?
No. Encryption is one security measure. Privacy also covers why you collect data, how long you keep it and what people can control.
What is data minimisation?
Collecting and keeping only the personal data that is adequate, relevant and necessary for your stated purpose.
Sources
This article is general information, not legal advice.
Last reviewed: 18 October 2026.
