Chapter 7 — Privacy and data protection: controls and verification
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Selecting controls"]
N2["7.2 Testing controls"]
N3["7.3 Operating over time"]
N4["7.4 Recording results"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Selecting controls"]
N2["7.2 Testing controls"]
N3["7.3 Operating over time"]
N4["7.4 Recording results"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 Selecting controls]
|
v
[7.2 Testing controls]
|
v
[7.3 Operating over time]
|
v
[7.4 Recording results]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) select controls for recruitment risks; (2) verify that controls operate; (3) record verification results.
7.1 Selecting controls
From her findings, Marta proposes controls: multi-factor authentication for all consultants, a block on sending CVs to personal email domains, a recorded candidate agreement before each submission to a client, the automated CV deletion job, the central access request log and separate storage for diversity data. Each control is linked to a risk and a principle. For example, the personal email block addresses confidentiality, while recorded agreement addresses transparency and fairness, because candidates should know where their CV is going before it is sent.
7.2 Testing controls
Marta tests each control with synthetic data and test accounts. She tries to send a synthetic CV to a personal email address and confirms the block appears with a clear message. She checks that the recruitment system refuses a client submission when the agreement box is empty. She confirms that the deletion job, in report-only mode, lists the expected number of expired profiles. One test fails: diversity data are still copied into the main system by an old import script, which the IT provider then removes.
7.3 Operating over time
Testing once shows a control can work; verification over time shows it keeps working. Marta sets a quarterly verification routine: check multi-factor coverage from the identity report, sample ten client submissions for recorded agreement, confirm deletion job success messages and review the access request log for overdue cases. Each check has an owner and an expected result. She explains that controls in small firms often decay when the person who set them up leaves, so routine checks protect against that loss of attention.
7.4 Recording results
Results are recorded in a verification register with the date, control, test method, result and any follow-up. The first quarter shows full multi-factor coverage, ten of ten sampled submissions with recorded agreement and no overdue requests. The register gives the managing director a factual picture of the controls and gives the data protection lead evidence of accountability under Article 5(2). Ms. Lin advises Marta to record failures as clearly as successes, because a register that never shows problems is not believed. The register is reviewed quarterly.
Worked example
Marta selects six controls linked to risks, tests them with synthetic data, finds an old import script copying diversity data, sets quarterly verification and records results in a register.
Synthetic case. Controls and results are synthetic; GDPR Article 5(2) is real.
Errors and limits
A passed test can hide gaps if the test is too narrow; vary test cases.
Exercises
- EX031 — Agreement control. Which principle does recorded agreement support? Rubric: 3 = transparency and fairness;; 2 = one;; 1 = vague;; 0 = none.
- EX032 — Failed test. Which test failed? Rubric: 3 = diversity data copied by an old import script;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX033 — Quarterly checks. Name two quarterly checks. Rubric: 3 = MFA coverage, submission sample, deletion success, overdue requests;; 2 = two;; 1 = one;; 0 = none.
- EX034 — Sample result. How many sampled submissions had recorded agreement? Rubric: 3 = 10 of 10;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX035 — Recording failures. Why record failures clearly? Rubric: 3 = registers without problems are not believed;; 2 = mentions credibility;; 1 = vague;; 0 = none.
Continue studying — lesson 07 (chapter 07 of 12)
← Chapter 06 · Course chapter index · Chapter 08 →
Continue to the next authored lesson.