Chapter 30 — Capstone assessment
Lesson map
Lesson 30 published. Map, example, EX088.
flowchart TD
N0["Learning outcomes"]
N1["30.1 Presentation"]
N2["30.2 Questions"]
N3["30.3 Reflection"]
N4["30.4 Next steps"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX088"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["30.1 Presentation"]
N2["30.2 Questions"]
N3["30.3 Reflection"]
N4["30.4 Next steps"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX088"]
[Learning outcomes]
|
v
[30.1 Presentation]
|
v
[30.2 Questions]
|
v
[30.3 Reflection]
|
v
[30.4 Next steps]
|
v
[Worked example] --> [Exercise EX088]
Learning outcomes
You will (1) present your capstone; (2) answer questions; (3) reflect.
30.1 Presentation
Aisha presents her work at Quayside to Mr. Reilly and the data protection officer. Her presentation follows the course: inventory, flows, rights, retention, monitoring and handoff. For each area she shows a finding, the fix and the evidence. She keeps the slides simple and uses numbers from her labs, such as 47 of 287 records in the first access response and 292 clips past retention at one club. She ends with the remaining gaps: free-text health notes, ten old recorders and manual vendor monitoring. Assessors note the honesty.
30.2 Questions
Assessors ask about limits, such as free-text health notes. The data protection officer asks how Quayside would detect a new free-text health risk, and Aisha explains the training and sampling approach. Mr. Reilly asks what she would do differently. She answers that she would have started monitoring earlier, because several problems had been present for months before anyone looked at them. She adds that she would have tested the access request process in her first month, since the 16% coverage result changed how the team viewed every other control.
30.3 Reflection
Aisha reflects that technical checks reveal real gaps. She reflects that many problems came from ordinary work: slow systems, firmware updates, forgotten files and bundled SDKs. Technical checks found them because they compared what systems actually did with what policies said. She also learned that fixes need owners and monitoring, or they quietly fail again, as the CCTV deletion showed twice. Her strongest lesson is that a synthetic member who walks through a whole process, from sign-up to deletion, reveals more than any checklist.
30.4 Next steps
She plans to study governance next. Mr. Reilly notes that privacy work continues after the course. After the course, Quayside offers Aisha a junior privacy technologist role. She plans to study governance, risk and compliance to understand how her technical checks fit into wider management systems. Mr. Reilly closes by noting that the questions she learned to ask will remain useful whatever technologies Quayside adopts in future years. Her first task in the new role is running the access request test again.
Worked example
Aisha presents, answers questions about limits and reflects on technical checks.
Synthetic case. The assessment is synthetic.
Errors and limits
Reflection should be honest about failures.
Exercises
- EX088 — Audience. Who assessed? Rubric: 3 = Mr. Reilly and the data protection officer;; 2 = both;; 1 = one;; 0 = none.
- EX089 — Limit asked. What limit was asked about? Rubric: 3 = free-text health notes;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX090 — Next. What does Aisha plan next? Rubric: 3 = governance study;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 30 (chapter 30 of 30)
← Chapter 29 · Course chapter index · Next course via chapter index →
The chapter index leads to the next course in the study path.