Chapter 33 — Privacy and data protection: safety and resilience
Lesson map
Lesson 33 published. Map, example, EX097.
flowchart TD
N0["Learning outcomes"]
N1["33.1 Resilience requirements"]
N2["33.2 Breaches as incidents"]
N3["33.3 Privacy during recovery"]
N4["33.4 Graceful degradation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX097"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["33.1 Resilience requirements"]
N2["33.2 Breaches as incidents"]
N3["33.3 Privacy during recovery"]
N4["33.4 Graceful degradation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX097"]
[Learning outcomes]
|
v
[33.1 Resilience requirements]
|
v
[33.2 Breaches as incidents]
|
v
[33.3 Privacy during recovery]
|
v
[33.4 Graceful degradation]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX097]
Learning outcomes
You will (1) plan for incidents that affect personal data; (2) design resilience that preserves privacy; (3) balance availability with confidentiality.
33.1 Resilience requirements
Article 32 requires the ability to restore availability and access to personal data in a timely manner after an incident. For telemedicine, unavailability of records during consultations can harm patients. Zara defines recovery objectives with clinicians: clinical records restored within four hours, video service within one hour. She designs backups and failover to meet them, and ensures backup copies are encrypted and access controlled. Resilience, she explains, is a privacy requirement as well as an operational one, because losing access to data harms patients just as disclosure does.
33.2 Breaches as incidents
The GDPR defines a personal data breach broadly, including loss of availability. If ransomware encrypts records and they cannot be restored quickly, that is a breach even if no data leave Pellmore. Zara works with the security team to align incident response with breach procedures: every security incident is assessed for personal data impact, and the data protection officer is involved early. EDPB Guidelines 9/2022 describe availability breaches and the assessment of risk, which she uses to train the incident team. Availability loss counts too.
33.3 Privacy during recovery
Recovery can create privacy risks. Restoring an old backup could reintroduce data that patients had erased or that were past retention. Zara's recovery runbook therefore reapplies the erasure log and retention table after any restore, before the system returns to service. She also limits who can access backups during recovery, since emergencies tempt teams to share access widely. She tests the runbook in a drill and finds that reapplying erasures takes forty minutes, which she includes in the recovery time objective. Restored backups need erasures replayed.
33.4 Graceful degradation
When parts of the platform fail, Zara wants the system to degrade safely. If the consent service is down, systems should treat consent as absent rather than assume it is present. If the access-check service is down, clinicians in a consultation get emergency access with enhanced logging and review afterwards, rather than no access. She documents these fail-safe and break-glass rules and agrees them with clinicians and the data protection officer. Designing failure behaviour in advance prevents improvised decisions during an outage.
Worked example
Zara sets recovery objectives with clinicians, treats availability loss as a potential breach, reapplies erasures after restores (forty minutes) and defines fail-safe consent and break-glass access.
Synthetic case. Objectives and drills are synthetic; GDPR Article 32 and EDPB Guidelines 9/2022 are real.
Errors and limits
Break-glass access can be abused; review every use promptly.
Exercises
- EX097 — Availability breach. Can ransomware without exfiltration be a personal data breach? Rubric: 3 = yes; loss of availability is a breach;; 2 = yes without reason;; 1 = no;; 0 = none.
- EX098 — Restore risk. What privacy risk does restoring a backup create, and how is it handled? Rubric: 3 = erased or expired data return; reapply erasure log and retention before service;; 2 = one part;; 1 = vague;; 0 = none.
- EX099 — Fail-safe consent. How should systems behave if the consent service is down? Rubric: 3 = treat consent as absent;; 2 = mentions caution;; 1 = assume present;; 0 = none.
Synthesis
Chapter 33 builds resilience. Chapter 34 integrates the platform.
Continue studying — chapter 33 of 50
← Chapter 32 (draft) · Course chapter index · Chapter 34 (draft) →