Chapter 27 — Privacy and data protection: control design
Lesson map
Lesson 27 published. Map, example, EX079.
flowchart TD
N0["Learning outcomes"]
N1["27.1 Types of control"]
N2["27.2 Consent management"]
N3["27.3 Controls linked to requirements"]
N4["27.4 Control owners"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX079"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["27.1 Types of control"]
N2["27.2 Consent management"]
N3["27.3 Controls linked to requirements"]
N4["27.4 Control owners"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX079"]
[Learning outcomes]
|
v
[27.1 Types of control]
|
v
[27.2 Consent management]
|
v
[27.3 Controls linked to requirements]
|
v
[27.4 Control owners]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX079]
Learning outcomes
You will (1) design preventive, detective and corrective privacy controls; (2) design consent management; (3) link controls to requirements and risks.
27.1 Types of control
Zara classifies controls as preventive, detective or corrective. Preventive controls stop problems: purpose-based access checks, field minimisation in forms. Detective controls notice problems: anomaly signals on record access, retention monitoring. Corrective controls fix problems: deletion jobs, breach response. She ensures each high-ranked risk has at least one of each type. For staff snooping, access checks prevent, anomaly signals detect, and disciplinary and notification procedures correct. A risk with only preventive controls is fragile because failures go unnoticed until harm appears. Good designs mix all three.
27.2 Consent management
Some Pellmore processing relies on consent, such as the newsletter and optional research participation. EDPB Guidelines 05/2020 require consent to be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Zara designs a consent service that stores what each patient agreed to, when and through which wording version. Withdrawal is one tap and propagates to all systems within a day. She ensures that care is never conditional on consent to marketing, which would make consent not freely given.
27.3 Controls linked to requirements
Zara extends her traceability matrix: each control now links to the requirements it satisfies and the risks it reduces. Gaps show up as risks without controls or controls without purpose. She finds a legacy control, a nightly copy of the records database to an old reporting server, that no requirement justifies. Removing it reduces exposure at no cost. The exercise shows that control design includes pruning, because old controls and processes can themselves become privacy risks when nobody remembers why they exist.
27.4 Control owners
Every control needs an owner who maintains it and reports on it. Zara assigns owners: the engineering lead for access checks, the data protection officer for consent wording, the operations manager for retention jobs. She writes a one-page control description for each, covering purpose, operation, evidence and failure response. Prof. Holm reminds her that ISO/IEC 27701:2025 expects documented controls with evidence of operation, and that owners are what keep controls alive after the engineers who designed them move on to other projects.
Worked example
Zara gives each high risk preventive, detective and corrective controls, designs a consent service meeting EDPB criteria, removes an unjustified nightly copy and assigns control owners.
Synthetic case. Controls are synthetic; EDPB Guidelines 05/2020 and ISO/IEC 27701:2025 are real.
Errors and limits
Too many controls create overhead and confusion; prune regularly.
Exercises
- EX079 — Control types for snooping. Give a preventive, detective and corrective control for staff snooping. Rubric: 3 = access checks; anomaly signals; disciplinary and notification procedures;; 2 = two;; 1 = one;; 0 = none.
- EX080 — Valid consent. What makes consent valid under EDPB Guidelines 05/2020? Rubric: 3 = freely given, specific, informed, unambiguous, easy to withdraw;; 2 = lists some;; 1 = wrong;; 0 = none.
- EX081 — Pruned control. What control did Zara remove, and why? Rubric: 3 = a nightly database copy to an old reporting server, justified by no requirement;; 2 = mentions copy;; 1 = vague;; 0 = none.
Synthesis
Chapter 27 designs controls. Chapter 28 implements them.
Continue studying — chapter 27 of 50
← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →