Chapter 2 — Privacy and data protection: current practice

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Mapping practice"]
  N2["2.2 Comparing laws"]
  N3["2.3 Frameworks"]
  N4["2.4 Gaps"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Mapping practice"]
  N2["2.2 Comparing laws"]
  N3["2.3 Frameworks"]
  N4["2.4 Gaps"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Mapping practice]
    |
    v
[2.2 Comparing laws]
    |
    v
[2.3 Frameworks]
    |
    v
[2.4 Gaps]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) map current privacy practice in a payments company; (2) compare GDPR and LGPD obligations; (3) identify gaps against good practice.

2.1 Mapping practice

Priscila maps Corvina's privacy programme: a data protection officer (called encarregado under the LGPD), a record of processing, a DPIA process, a rights request team, vendor contracts and training. She interviews team leads to see how each works in practice. She finds that the record of processing exists but has not been updated for a year, and that DPIAs are done only for new products, not for changes to existing ones like the fraud model. She also finds two vendors missing from the record of processing.

2.2 Comparing laws

Priscila builds a comparison of obligations under the GDPR and LGPD. Both require lawful bases, transparency, security and rights handling. The LGPD lists ten legal bases in Article 7, including credit protection, which is relevant to Corvina. The GDPR uses six bases in Article 6. Breach notification under the GDPR has a 72-hour target; the LGPD requires communication within a reasonable time, as defined by the national authority. She designs processes that meet the stricter requirement in each area. Where rules diverge, the stricter one becomes the group standard.

2.3 Frameworks

Priscila compares Corvina's programme with the NIST Privacy Framework 1.0 and ISO/IEC 27701:2025. The NIST framework's functions help her see that Corvina is strong on Protect-P but weaker on Identify-P, because the inventory is stale. ISO/IEC 27701 expects documented management system processes, which Corvina partly has. She uses the frameworks as a structured checklist rather than as certification targets, at least for now. The NIST Privacy Framework helps her describe target outcomes for the board, while ISO/IEC 27701 control lists help her check whether supplier management and training are covered in practice.

2.4 Gaps

Priscila lists gaps: a stale record of processing, DPIAs not triggered by changes, vendor contracts without clear deletion terms, and training that is generic. She ranks them by risk. The stale inventory is first because other processes depend on it. She presents the gap list to Corvina's executive committee with a twelve-month plan. Dr. Ward comments that a credible gap list is specific, ranked and owned, rather than a long list of everything that could be better. Her top gap is unreviewed product changes, owned by the product director.

Worked example

Priscila maps Corvina's programme, compares GDPR and LGPD obligations, uses NIST Privacy Framework and ISO/IEC 27701 as checklists and ranks four gaps with a twelve-month plan.

Synthetic case. Corvina's programme is synthetic; GDPR Article 6, LGPD Article 7, the NIST Privacy Framework 1.0 and ISO/IEC 27701:2025 are real.

Errors and limits

Comparisons of laws simplify; national authority regulations add detail.

Exercises

• EX006 — DPIA trigger gap. What gap did Priscila find in DPIA practice?
  Show marking criteria

  Rubric: 3 = DPIAs only for new products, not changes;; 2 = mentions changes;; 1 = vague;; 0 = none.
• EX007 — LGPD bases. How many legal bases does LGPD Article 7 list, and which suits payments?
  Show marking criteria

  Rubric: 3 = ten; credit protection is relevant;; 2 = number only;; 1 = wrong;; 0 = none.
• EX008 — Stricter requirement. How does Priscila handle differences between the laws?
  Show marking criteria

  Rubric: 3 = designs processes meeting the stricter requirement;; 2 = mentions stricter;; 1 = picks one;; 0 = none.
• EX009 — Framework role. How does Priscila use the frameworks?
  Show marking criteria

  Rubric: 3 = as structured checklists, not certification targets;; 2 = mentions checklist;; 1 = certify;; 0 = none.
• EX010 — First gap. Why is the stale inventory ranked first?
  Show marking criteria

  Rubric: 3 = other processes depend on it;; 2 = mentions dependency;; 1 = random;; 0 = none.

Synthesis

Chapter 2 maps practice. Chapter 3 gathers specialist evidence.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →