Catalog
concept#Security#Governance#Data

Data Protection

Protection of personal and sensitive data through organizational, technical and legal measures.

Data protection defines principles, organizational rules and technical controls to safeguard personal and sensitive data from misuse, loss, or unauthorized access.
Established
Medium

Classification

  • Medium
  • Organizational
  • Organizational
  • Intermediate

Technical context

Identity and access management systems (IAM)Security information and event management (SIEM)Data loss prevention (DLP) and encryption solutions

Principles & goals

Data minimization: collect and process only necessary data.Transparency: ensure traceability of processing and purposes.Accountability: clear roles, responsibilities and demonstrability.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Incomplete inventory leads to blind spots.
  • Missing responsibilities delay incident responses.
  • Technical controls may be misconfigured or bypassed.
  • Consider data minimization already in requirements phase.
  • Introduce automated lifecycle management and deletion policies.
  • Conduct regular mandatory training and awareness measures.

I/O & resources

  • Data inventory with processing purposes
  • Legal requirements and policies
  • Technical architecture and system overviews
  • Data protection policies and procedures
  • DPIA reports and risk assessments
  • Audit and evidence documentation

Description

Data protection defines principles, organizational rules and technical controls to safeguard personal and sensitive data from misuse, loss, or unauthorized access. It includes legal bases, roles and responsibilities, endpoint and lifecycle controls, and measurable audits to reduce risk and ensure regulatory compliance across systems and processes.

✔

  • Reduced risk of breaches and regulatory fines.
  • Increased trust from customers and partners.
  • Clearly defined processes facilitate audits and evidence.

✖

  • Complete protection is not achievable; residual risks remain.
  • Legal requirements vary by jurisdiction and over time.
  • Implementation can incur initial effort and costs.

  • Number of reported data breaches

    Counts security or data protection incidents in the period.

  • Time-to-detect

    Time between incident occurrence and detection.

  • Percentage of encrypted sensitive records

    Share of sensitive data stored encrypted.

GDPR implementation in financial sector

Company-wide introduction of processing registers, encryption requirements and notification processes to satisfy regulatory obligations.

DPIA for an analytics project

Conducting a data protection impact assessment before deploying new tracking and analytics features.

Rollout of an access control system

Introducing role-based access controls and logging for HR and customer data.

1

Inventory all relevant personal data and systems.

2

Conduct DPIAs for critical processing activities.

3

Introduce technical controls (encryption, RBAC, logging).

4

Define responsibilities and train staff.

5

Regular monitoring, audits and continuous improvement.

⚠️ Technical debt & bottlenecks

  • Legacy systems without encryption or audit logs.
  • Manual deletion and request processes instead of automation.
  • No central inventory leads to inconsistent controls.
Access management and permissionsData inventory and classificationEncryption and key management
  • Collecting customer data for marketing without review.
  • Sharing personal data with third parties without contract.
  • Disabling encryption due to performance concerns.
  • Unclear data ownership between business units.
  • Outdated policies that do not cover current technologies.
  • Missing consideration of international data transfers.
Legal and compliance knowledge (e.g. GDPR)IT security and cryptography fundamentalsData classification and risk analysis skills
Protection of sensitive and personal dataAuditability for regulatory requirementsAvailability of secure access controls and encryption
  • • Legal requirements per jurisdiction (e.g. GDPR, local laws).
  • • Technological limits of existing systems.
  • • Budgetary and personnel resources for implementation and operation.