What Is Data Privacy? Key Principles, Laws & Best Practices
What Is Data Privacy?
Data privacy is the right of individuals to control how their personal information is collected, stored, used, shared, and deleted by organizations. It is the principle that personal data belongs, in a meaningful sense, to the person it describes — and that organizations which collect and process that data do so only for legitimate purposes, with appropriate safeguards, and with respect for the individual’s rights and preferences.
Data privacy is distinct from data security, though the two are deeply interconnected. Data security is about protecting data from unauthorized access, breaches, and theft. Data privacy is about ensuring that data is used appropriately by those who are authorized to access it. An organization can have strong data security — robust encryption, strict access controls, no breaches — while still violating data privacy by using personal data for purposes the individual never consented to, retaining it longer than necessary, or sharing it with third parties without disclosure.
TL;DR — Key Takeaways
• Data privacy is the right of individuals to control how their personal information is collected, used, and shared.
• It differs from data security: security protects data from unauthorized access; privacy governs how authorized parties use it.
• GDPR, CCPA, and HIPAA are the most significant data privacy laws globally.
• Key principles: purpose limitation, data minimization, consent, transparency, and individual rights.
• Organizations that handle personal data have legal obligations that extend beyond technical security controls.
How Does Data Privacy Differ from Data Security?
The relationship between data privacy and data security is best understood as overlapping but distinct disciplines. Data security is a technical domain: it encompasses the controls, systems, and processes that prevent unauthorized parties from accessing data. Data privacy is a legal, ethical, and governance domain: it defines who may use data, for what purposes, under what conditions, and with what transparency to the individuals whose data it is.
Data Privacy
Focus: Appropriate use of data by authorized parties
Domain: Legal, ethical, governance
Key questions: Should we collect this? For how long? With whose consent?
Governed by: Privacy laws (GDPR, CCPA, HIPAA)
Failure consequence: Privacy violation, even without a breach
Data Security
Focus: Protection of data from unauthorized access
Domain: Technical, operational
Key questions: Can unauthorized parties access this? Is it encrypted?
Governed by: Security frameworks (ISO 27001, SOC 2, NIST)
Failure consequence: Data breach, even with lawful use
Strong data security is a prerequisite for meaningful data privacy — you cannot protect individuals’ rights over their data if that data can be stolen by unauthorized parties. But security alone is not sufficient for privacy. Organizations must also govern how data is collected, what it is used for, how long it is retained, and with whom it is shared.
Why Does Data Privacy Matter?
The significance of data privacy has expanded dramatically in the digital age, driven by the sheer volume of personal data that organizations now collect and the potential for harm when that data is misused. Personal data collected ostensibly for one purpose — a customer loyalty program, a job application, a medical appointment — can be used to discriminate, manipulate, surveil, or defraud individuals in ways they never anticipated when they provided it. Beyond individual harm, data privacy has significant commercial implications. Organizations that fail to handle personal data appropriately face regulatory fines that can reach hundreds of millions of euros under GDPR, reputational damage that undermines customer trust, and civil liability from individuals whose privacy rights have been violated.
What Are the Core Principles of Data Privacy?
Most data privacy frameworks, regardless of jurisdiction, are built on a consistent set of foundational principles. Purpose limitation requires that personal data be collected for specified, explicit, and legitimate purposes, and not used in ways incompatible with those purposes. Data minimization requires that organizations collect only the personal data that is necessary for the stated purpose. Storage limitation requires that personal data be retained only as long as necessary for the purpose for which it was collected. Accuracy requires that personal data be kept up to date. Transparency and fairness require that individuals be informed about how their data will be used in a way that is clear, accessible, and honest.
What Are the Major Data Privacy Laws?
The General Data Protection Regulation (GDPR) is the most comprehensive and globally influential data privacy law in force. Enacted by the European Union and applicable since May 2018, GDPR applies to any organization — regardless of where it is based — that processes the personal data of individuals in the European Economic Area. Fines for serious violations can reach €20 million or 4% of global annual turnover, whichever is higher. The California Consumer Privacy Act (CCPA) and its successor the CPRA give California residents rights over their personal data broadly comparable to GDPR. The Health Insurance Portability and Accountability Act (HIPAA) governs the privacy and security of protected health information (PHI) in the United States. Beyond these three frameworks, data privacy is regulated by dozens of national laws globally, including Brazil’s LGPD, India’s DPDP Act, Canada’s PIPEDA, Australia’s Privacy Act, and China’s PIPL.
What Rights Do Individuals Have Under Data Privacy Law?
A defining feature of modern data privacy frameworks is the recognition that individuals have enforceable rights over their personal data. The right of access gives individuals the right to know what personal data an organization holds about them and to receive a copy. The right to erasure — sometimes called the right to be forgotten — gives individuals the right to request deletion of their personal data in certain circumstances. The right to portability gives individuals the right to receive their data in a structured, machine-readable format. The right to rectification enables correction of inaccurate data. The right to object allows individuals to oppose certain types of processing, including direct marketing. For organizations, these rights create operational obligations: the ability to locate all data held about a specific individual, to delete it on request, to respond to access requests within defined timeframes, and to maintain records demonstrating compliance.
What Are the Lawful Bases for Processing Personal Data?
Under GDPR and similar frameworks, every processing activity involving personal data must have a lawful basis — a legally recognized justification for collecting and using the data. The six lawful bases under GDPR are consent (the individual has given clear, specific, informed, and unambiguous consent), contract (processing is necessary to perform a contract with the individual), legal obligation (processing is required by law), vital interests (processing is necessary to protect someone’s life), public task (processing is necessary for a task in the public interest), and legitimate interests (processing is necessary for the organization’s legitimate interests, provided those interests are not overridden by the individual’s rights). Choosing the appropriate lawful basis is not merely a paperwork exercise — it determines what rights individuals have with respect to the processing and what obligations the organization carries.
What Is Privacy by Design?
Privacy by design is the principle that data privacy should be embedded into the design and architecture of systems, processes, and products from the outset, rather than added as an afterthought. Developed by Dr. Ann Cavoukian and subsequently incorporated into GDPR as a legal requirement, it holds that privacy is most effectively protected when it is built into the default operation of a system. In practice, privacy by design means that engineers and product managers consider data collection, retention, and sharing decisions at the design stage: what data is strictly necessary for the feature to function? Can data be anonymized or pseudonymized rather than stored in identifiable form? Are retention and deletion mechanisms built into the data model from the start?
How Does Data Privacy Affect Vendor Relationships?
One of the most practically significant dimensions of data privacy regulation is its impact on vendor and supplier relationships. Under GDPR, when an organization (the data controller) shares personal data with a third-party service provider (the data processor), the controller must ensure that the processor provides sufficient guarantees about their data protection practices — typically through a Data Processing Agreement (DPA). This requirement is a primary driver of the vendor risk assessments and security questionnaires that software vendors increasingly receive from enterprise customers. A vendor’s ability to answer these questions clearly — ideally backed by a current SOC 2 report or ISO 27001 certification — is directly relevant to their ability to win and retain enterprise customers.
What Are Common Data Privacy Violations and Their Consequences?
Data privacy violations range from technical failures to deliberate misuse. The most common categories include unlawful data collection (collecting data without a valid legal basis or adequate notice), purpose creep (using data for purposes other than those disclosed at collection), failure to honor data subject rights (ignoring or unduly delaying responses to access or erasure requests), inadequate data processor management (failing to have appropriate DPAs in place), and unlawful international data transfers. Regulatory enforcement has become significantly more active in recent years. GDPR fines issued since 2018 total several billion euros, with major penalties against technology companies, financial institutions, and public authorities.
How Do You Build a Data Privacy Program?
Organizations building or maturing their data privacy programs share several common foundational elements. A data inventory or Record of Processing Activities (ROPA) — required by GDPR Article 30 — maps what personal data the organization holds, where it came from, what it is used for, where it is stored, and with whom it is shared. Privacy impact assessments (PIAs) or Data Protection Impact Assessments (DPIAs) evaluate the privacy risks of new projects before they are implemented. Privacy notices must be accurate, comprehensive, and written in plain language. And incident response procedures specific to personal data breaches ensure that notification obligations can be met within the tight timeframes that GDPR and other regulations impose.
How Steerlab Helps Vendors With Data Privacy Questions
For software vendors who receive security questionnaires and vendor risk assessments from enterprise customers, data privacy questions — about GDPR compliance, data retention, sub-processors, international transfers, and DPA availability — are among the most frequently asked. Steerlab.ai helps vendors respond to these assessments efficiently, drawing from a centralized knowledge base of approved answers so privacy and legal teams can focus on substance rather than repetitive drafting.
Frequently Asked Questions
What is data privacy?
Data privacy is the right of individuals to control how their personal information is collected, stored, used, shared, and deleted by organizations. It encompasses both individual rights and organizational obligations, and is governed by laws including GDPR, CCPA, and HIPAA.
What is the difference between data privacy and data security?
Data security protects data from unauthorized access, breaches, and theft. Data privacy ensures that data is used appropriately by those who are authorized to access it. Both are necessary: security without privacy means authorized parties can still misuse data; privacy without security means unauthorized parties can access it.
What is GDPR?
GDPR (General Data Protection Regulation) is a European Union law, in force since May 2018, governing the collection, use, and protection of personal data of individuals in the EEA. It applies to any organization worldwide that processes the personal data of EU residents. Fines for serious violations can reach €20 million or 4% of global annual turnover.
What rights do individuals have under data privacy laws?
The most significant rights recognized across multiple jurisdictions include the right of access, the right to erasure (right to be forgotten), the right to portability, the right to rectification, and the right to object to certain types of processing including direct marketing.
What is privacy by design?
Privacy by design is the principle that data privacy should be embedded into systems, products, and processes from the outset, rather than added as an afterthought. It is a legal requirement under GDPR and involves making decisions about data minimization, retention, and anonymization at the design stage rather than retrofitting them into existing systems.
Why do enterprise software vendors receive data privacy questions in security questionnaires?
Under GDPR and similar frameworks, organizations sharing personal data with third-party vendors must verify that those vendors provide adequate data protection. This obligation is discharged through vendor security assessments that include questions about data retention, sub-processors, international transfers, DPA availability, and GDPR compliance status.
What is a Data Processing Agreement (DPA)?
A Data Processing Agreement is a contract required under GDPR between a data controller and a data processor. It specifies the subject matter, duration, nature, and purpose of processing, the type of personal data involved, the categories of individuals affected, and the obligations and rights of both parties.
What are the most common data privacy violations?
The most common violations include collecting data without a valid legal basis, using data for purposes other than those disclosed at collection, failing to honor data subject rights within required timeframes, failing to have appropriate DPAs with vendors, and transferring personal data internationally without adequate safeguards.
