Chapter 30 — Laboratory II | Bachelor's Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 30 — Laboratory II

Lesson map

Lesson 30 published. Map, example, EX088.

flowchart TD
  N0["Learning outcomes"]
  N1["30.1 End-to-end test"]
  N2["30.2 Vendor deletion"]
  N3["30.3 Process improvements"]
  N4["30.4 Reflection"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX088"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["30.1 End-to-end test"]
  N2["30.2 Vendor deletion"]
  N3["30.3 Process improvements"]
  N4["30.4 Reflection"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX088"]

[Learning outcomes]
    |
    v
[30.1 End-to-end test]
    |
    v
[30.2 Vendor deletion]
    |
    v
[30.3 Process improvements]
    |
    v
[30.4 Reflection]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX088]

Learning outcomes

You will (1) test end-to-end processes; (2) test vendor deletion; (3) improve processes from test results.

30.1 End-to-end test

In Laboratory II Elena tests the full life of a synthetic pupil: admission, class assignment, app accounts, photographs with consent, an access request and leaving the trust. She checks that each step creates, uses and deletes data as designed. When the pupil leaves, the management system marks them as left, single sign-on removes app access, and the retention schedule sets deletion dates. The test confirms that the main systems work together. A synthetic pupil leaves the trust. Each system is checked for the pupil's record.

30.2 Vendor deletion

The untested area from Laboratory I was vendor deletion. Elena asks three approved app vendors to delete the synthetic pupil's data and confirm. Two confirm within a week with deletion records. One replies that data are retained for a year for analytics. That contradicts the trust's agreement, which requires deletion on request. Elena escalates to the data protection lead, who contacts the vendor to enforce the contract. The vendor kept the record. The app's support page confirmed the one-year analytics retention.

30.3 Process improvements

Elena recommends adding vendor deletion confirmation to the leaver process, with a reminder if no confirmation arrives in two weeks. She also recommends including deletion testing in yearly vendor reviews. She notes that contracts are only as strong as the trust's ability to check them, and that a simple test with a synthetic pupil revealed a real gap that paperwork had hidden. Vendor deletion is now confirmed in writing, and the synthetic pupil test is repeated each summer. The contract now has a deletion clause.

30.4 Reflection

Elena reflects on the two laboratories. The first tested controls in isolation; the second tested processes across systems and vendors. The second found more serious gaps, because failures often occur at boundaries. Dr. Asante notes that end-to-end testing with synthetic subjects is one of the most effective tools in data protection practice, and that it should become a routine part of the trust's operations rather than a one-off exercise. The test took one afternoon. It found what audits missed for years.

Worked example

Elena tests a synthetic pupil's life cycle end to end, finds a vendor retaining data for a year against its contract, and adds deletion confirmations to the leaver process.

Synthetic case. The pupil and vendors are synthetic.

Errors and limits

Vendors may confirm deletion without verifying it; request evidence where possible.

Exercises

EX088 — Vendor gap. What did the vendor deletion test reveal? Rubric: 3 = one vendor kept data for a year contrary to its contract;; 2 = mentions retention;; 1 = vague;; 0 = none.
EX089 — Leaver process. What did Elena add to the leaver process? Rubric: 3 = vendor deletion confirmation with a two-week reminder;; 2 = mentions confirmation;; 1 = vague;; 0 = none.
EX090 — Boundaries. Why did the second laboratory find more serious gaps? Rubric: 3 = failures often occur at boundaries between systems and vendors;; 2 = mentions boundaries;; 1 = luck;; 0 = none.

Synthesis

Chapter 30 tests processes. Chapter 31 examines advanced cases.

Continue studying — chapter 30 of 40

← Chapter 29 (draft) · Course chapter index · Chapter 31 (draft) →