◇ OpenCyber Academy
Technical · Chapter 11 · English

Chapter 11 — Privacy and data protection: verification

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Privacy and data protection: verification

Lesson map

Lesson 11 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 What verification means"]
  N2["11.2 Sampling accounts"]
  N3["11.3 Testing operation"]
  N4["11.4 Honest reporting"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 What verification means"]
  N2["11.2 Sampling accounts"]
  N3["11.3 Testing operation"]
  N4["11.4 Honest reporting"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]

[Learning outcomes]
    |
    v
[11.1 What verification means]
    |
    v
[11.2 Sampling accounts]
    |
    v
[11.3 Testing operation]
    |
    v
[11.4 Honest reporting]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) verify that privacy controls work as designed; (2) use sampling; (3) report verification honestly.

11.1 What verification means

Leila distinguishes three questions: is the control designed correctly, is it implemented as designed, and does it operate consistently over time? A role design may be correct on paper, implemented with an error and later changed by an administrator. Verification needs evidence for each question. Mr. Okafor gives an example from her own work: the network separation design was correct, the pilot clinic implementation was tested, but nobody has yet checked whether the other clinics were configured the same way. Operation is the hardest to prove.

11.2 Sampling accounts

Leila verifies access roles by sampling. She takes twenty staff accounts at random across the eight clinics and compares each account's role with the person's job and current employment. Eighteen match. One receptionist still has clinical access from an old role, and one dental nurse transferred to another clinic still has access to her previous clinic's patients. She reports both and asks the practice managers to correct them, and she notes that a sample estimates the error rate but cannot prove that all other accounts are correct.

11.3 Testing operation

For the deletion job that removes old reminder records, Leila checks the job's success log for the past three months and finds two missing days. She asks the IT contractor, who explains that the server was restarted for updates on those days and the job did not run. The next day's run caught up, so no data were kept too long. Leila records this as a minor operational gap and recommends that the job report its run time, so a missed day is visible immediately.

11.4 Honest reporting

Leila's verification report lists each control, the evidence, the result and any limits. She marks controls as verified, partly verified or not yet verified, and she avoids describing a sample as a full check. For network separation, she writes: verified in one clinic, not yet verified in seven. The data protection officer appreciates the clarity, because it shows exactly where further work is needed. Mr. Okafor notes that inflated verification reports create false confidence, which is worse than an honest gap. Gaps are listed first.

Worked example

Leila separates design, implementation and operation, samples twenty accounts and finds two errors, checks deletion job history, and reports verified, partly verified and not yet verified controls.

Synthetic case. Results are synthetic.

Errors and limits

Samples estimate rates; they do not certify every account.

Exercises

Continue studying — lesson 11 (chapter 11 of 18)

← Chapter 10 · Course chapter index · Chapter 12 →

Continue to the next authored lesson.