◇ OpenCyber Academy
Engineering · Chapter 28 · English

Chapter 28 — Privacy and data protection: implementation I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 28 — Privacy and data protection: implementation I

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 Purpose tags in the schema"]
  N2["28.2 Consent propagation"]
  N3["28.3 Safe deployment"]
  N4["28.4 Documentation as code"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 Purpose tags in the schema"]
  N2["28.2 Consent propagation"]
  N3["28.3 Safe deployment"]
  N4["28.4 Documentation as code"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 Purpose tags in the schema]
    |
    v
[28.2 Consent propagation]
    |
    v
[28.3 Safe deployment]
    |
    v
[28.4 Documentation as code]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) implement purpose tags and access checks; (2) implement consent propagation; (3) deploy changes safely.

28.1 Purpose tags in the schema

Zara implements purpose tags in Pellmore's database schema. Each column carries metadata listing the purposes allowed to read it. The access library from Chapter 9 checks the caller's declared purpose against the tags before returning data. She migrates tags gradually, starting with clinical tables. During migration, any read of an untagged column is logged as a warning rather than blocked, so the team can find missing tags without breaking the service. After two weeks the warnings stop and the check is switched to blocking mode.

28.2 Consent propagation

The consent service publishes events when a patient gives or withdraws consent. Downstream systems, such as the email platform and the research extract, subscribe and update their records. Zara implements idempotent handlers, so repeated events do no harm, and a daily reconciliation that compares each system's consent state with the central record. The reconciliation finds that the email platform missed withdrawals during a network outage. She fixes the handler to retry and adds an alert, showing why event systems need a check that does not depend on the events themselves.

28.3 Safe deployment

Privacy changes can break services. Zara deploys behind feature flags, enabling the new checks for a small group of internal test accounts, then for one clinic, then for all. She monitors errors and access denials at each step. One clinic's reporting tool fails because it read a column without a purpose. The team adds the purpose and continues. She records the incident and the fix. Gradual deployment, she notes, lets privacy controls be strict without becoming the reason a clinic cannot work on a busy morning.

28.4 Documentation as code

Zara keeps purpose tags, retention periods and consent purposes in version-controlled configuration files. Changes go through code review with the privacy questions from Chapter 14. The record of processing is generated partly from these files, so it stays aligned with the system. She explains that documentation generated from configuration is more reliable than documents written separately, because it changes when the system changes. Pellmore's data protection officer welcomes the approach because it gives an up-to-date view of processing without asking engineers to write reports by hand.

Worked example

Zara implements purpose tags with a warn-then-block migration, consent events with reconciliation that catches missed withdrawals, flag-based rollout and processing records generated from configuration.

Synthetic case. Implementation details are synthetic.

Errors and limits

Generated documentation covers only what is configured; manual processes still need description.

Exercises

Synthesis

Chapter 28 implements controls. Chapter 29 measures them.

Continue studying — chapter 28 of 50

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →