Chapter 12 — Final review and transfer
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Review"]
N2["12.2 Transfer"]
N3["12.4 Development"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Review"]
N2["12.2 Transfer"]
N3["12.4 Development"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX056"]
[Learning outcomes]
|
v
[12.1 Review]
|
v
[12.2 Transfer]
|
v
[12.4 Development]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes
You will (1) review a two-year programme of change; (2) transfer lessons to other contexts; (3) plan continuing development.
12.1 Review
Priscila reviews two years at Corvina. The programme moved from stale records and generic training to change screening, procurement controls, a champion network, board indicators and automated retention. The consent banner test changed design practice. The GPS decision showed how evidence supports necessity. Two red indicators remain: late breach notification and processors without agreements. She presents a plan for each, recognising that improvement is continuous. Breach notification is late because vendors report slowly, so contracts will set a 24-hour vendor reporting duty.
12.2 Transfer
Dr. Ward asks what Priscila would transfer to another organisation. She lists principles rather than tools: separate constraints from trade-offs; test necessity with evidence; measure behaviour, not only policy; report honestly to the board; and integrate privacy into existing processes. She notes that tools and thresholds would differ in a hospital or a public agency, but that these principles would still guide good decisions. In a hospital, for example, clinical safety would add constraints and patients would replace customers in the harm column of the register.
12.3 Limits
Priscila notes limits of her experience. Corvina is a mid-sized firm with board support; smaller firms may lack resources, and larger ones may face more complexity. Her evidence from tests is local. She avoids presenting her programme as a template. She also notes that laws and standards evolve, as the 2025 edition of ISO/IEC 27701 shows, so practices must be updated over time. Her results come from one firm in two countries, with synthetic data in the labs and a particular regulatory history. A different culture or regulator could change what works best.
12.4 Development
Priscila plans continuing development: deeper knowledge of privacy engineering, especially differential privacy for partner statistics; experience with supervisory authority interactions; and mentoring privacy champions. She also plans to present her A/B test at a practitioner conference. Dr. Ward closes the course by noting that the best privacy leaders combine evidence, ethics and organisational skill, and that Priscila has shown all three. Priscila plans to mentor the privacy champions and to publish an anonymised case study of the consent test for other practitioners in the region.
Worked example
Priscila reviews the programme, transfers five principles, states limits of her experience and plans development in privacy engineering, regulatory work and mentoring.
Synthetic case. The review is synthetic; ISO/IEC 27701:2025 is real.
Errors and limits
Self-review is biased; ask colleagues and auditors for their view.
Exercises
- EX056 — Remaining red. Which indicators remain red after two years? Rubric: 3 = late breach notification and processors without agreements;; 2 = one;; 1 = vague;; 0 = none.
- EX057 — Transferable principles. Name three transferable principles. Rubric: 3 = e.g. separate constraints from trade-offs; test necessity; report honestly;; 2 = two;; 1 = tools;; 0 = none.
- EX058 — Not a template. Why does Priscila avoid presenting her programme as a template? Rubric: 3 = contexts and resources differ;; 2 = mentions context;; 1 = universal;; 0 = none.
- EX059 — Evolving standards. Give an example of an evolving standard she must track. Rubric: 3 = ISO/IEC 27701:2025 edition;; 2 = mentions ISO;; 1 = vague;; 0 = none.
- EX060 — Development areas. Name two development areas Priscila plans. Rubric: 3 = privacy engineering/DP, regulator interactions, mentoring;; 2 = one;; 1 = vague;; 0 = none.
Synthesis
Chapter 12 completes the postgraduate route. The worked results follow, then the references.
Continue studying — chapter 12 of 12
← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →