Data privacy is the responsible control of information about people throughout its entire lifecycle: collection, use, sharing, retention, access and disposal. It asks not only whether someone can get into a system, but also whether the information was collected for a legitimate, understood purpose, used fairly, kept only as long as needed and handled in ways that avoid harm.
What is data privacy?
Data privacy concerns decisions about information that identifies or relates to people, whether the information is held by an app, employer, public agency, website, broker or household. A privacy problem can occur even when no attacker breaks in. Excessive collection, unexpected secondary use, indefinite retention or an overly broad sharing arrangement can expose people to embarrassment, stigma, discrimination, economic loss or physical harm.
As an Amazon Associate I earn from qualifying purchases.
NIST describes privacy risk as arising from data processing across the lifecycle, from collection through disposal. That lifecycle view is why deleting old records, limiting internal access and explaining a product’s data practices belong in privacy work alongside breach prevention.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How is data privacy different from data security?
Security protects information and systems against unauthorized access, loss or disclosure. Privacy asks a wider set of questions: should the information be collected, for what purpose, how much is necessary, who should receive it, how long should it remain and what effects could processing have on people?
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Question | Data security | Data privacy |
|---|---|---|
| Primary concern | Prevent unauthorized access, alteration, loss or disclosure. | Ensure collection and processing are appropriate, expected, limited and accountable. |
| Typical controls | Access controls, authentication, monitoring, backups and technical safeguards. | Purpose decisions, data minimisation, retention schedules, notices, rights handling and access limits. |
| Can risk exist without a breach? | Usually focuses on compromise or loss of confidentiality, integrity or availability. | Yes. Authorized processing can still be excessive, surprising or harmful. |
| Relationship | Contributes to privacy risk management. | Includes security but is not solved by security alone. |
NIST states that cybersecurity risk management contributes to privacy risk management but is not sufficient by itself.
What are the basic data privacy principles?
The following are the GDPR principles summarized by the European Commission. They are legal requirements for organizations within the GDPR’s scope, not a universal privacy law for every country.
Lawfulness, fairness and transparency
Processing needs a lawful basis, must be fair to the people affected and must be explained in clear language rather than hidden in confusing notices.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Purpose limitation
Collect and use information for specified, legitimate purposes. A later use that is unrelated or unexpected may require a new assessment or legal basis.
Data minimisation
Collect only the information that is adequate, relevant and necessary for the stated purpose. A field should not exist merely because it might be useful someday.
Accuracy
Keep personal information accurate and up to date, and provide ways to correct information that is wrong.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Storage limitation
Do not retain personal information longer than the purpose requires. Retention periods should be defined, reviewed and followed rather than left indefinite.
Recommended Free Tools
Integrity and confidentiality
Use appropriate safeguards to protect information against unauthorized or unlawful processing, accidental loss, destruction or damage.
Accountability
The organization is responsible for compliance and must be able to demonstrate how it meets these principles through decisions, records and controls.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should people be told about processing?
Under the GDPR explanation from the European Commission, a privacy notice should give people usable information about the processing that affects them. That includes:
- the purposes for processing and the legal basis relied on;
- the categories of personal data involved;
- how long the data will be retained, or how that period is decided;
- the recipients or categories of recipients;
- relevant transfers to other countries or international organizations; and
- the rights available to the individual and how to exercise them.
A notice that omits these practical details may be technically long but still fail to make the processing understandable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How organizations can manage privacy risk
A workable privacy program turns the lifecycle into repeatable decisions and evidence. A plain-language sequence is:
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- Map processing: record what information is collected, where it comes from, why it is used, where it moves and when it is deleted.
- Assess people and harms: identify who could be affected and consider consequences such as exposure, discrimination, financial loss or physical danger.
- Set and communicate the purpose: establish the legal and operational reason for processing and explain it before or when collection occurs.
- Reduce collection: remove fields, sensors, permissions and copies that are not necessary.
- Set review and deletion points: assign retention periods, review exceptions and securely dispose of records when the purpose ends.
- Constrain access and sharing: give staff, vendors and systems only the access they need, and document recipients and transfers.
- Build privacy into design and defaults: address privacy during product and process design instead of treating it as a late compliance check.
- Document accountability: keep the rationale, controls, reviews and evidence needed to show that responsibilities are being met.
What is the NIST Privacy Framework?
NIST’s Privacy Framework is a voluntary, law-agnostic risk-management tool. It helps an organization organize privacy outcomes and conversations; adopting it does not itself create legal compliance or guarantee compliance with any law.
The five Functions
- Identify-P: understand data processing and the privacy risks it can create.
- Govern-P: establish governance, roles, policies and risk tolerance.
- Control-P: support people and processes that let individuals exercise appropriate control over data.
- Communicate-P: make processing and privacy risks understandable to relevant audiences.
- Protect-P: put safeguards in place to manage privacy risk.
Profiles and Implementation Tiers
Profiles describe current activities or desired outcomes, allowing an organization to compare its present state with a target state. Implementation Tiers describe the organization’s approach and capacity for managing privacy risk. They help tailor work to context and resources; neither turns the Framework into a law or a certification.
How can individuals protect personal information?
- Share less: question optional fields, app permissions and requests for identity details that are unrelated to the service you need.
- Check the purpose: read what a service says it will do with information before submitting it, especially when data may be shared with partners.
- Review access: remove old app connections and avoid giving every account or employee more access than necessary.
- Keep records only as long as needed: delete unused accounts, exports and local copies, while observing any legitimate record-keeping obligation.
- Use security controls: strong unique passwords, multifactor authentication, updates and protected backups reduce unauthorized access, but they do not make unnecessary collection acceptable.
- Exercise available rights: use the provider’s correction, access, deletion or objection process where applicable, and keep a record of the request.
- Dispose of paper safely: cross-cut shredding is a sensible option for paper records containing personal information. It is one disposal measure, not comprehensive privacy protection.
Which laws apply?
There is no single worldwide data-privacy rule. Obligations depend on jurisdiction, the type of information, the organization’s role and the activity involved. The GDPR principles above apply within the GDPR’s scope; a voluntary NIST framework cannot replace them. Other countries, states and sectors may impose different duties and rights.
U.S. consumer-health information example
The U.S. Federal Trade Commission tells businesses handling consumer health information to consider the Health Insurance Portability and Accountability Act (HIPAA), the FTC Act and the Health Breach Notification Rule. Coverage is not identical for every health app or business, so the applicable regime depends on the organization’s facts and role.
The FTC also describes enforcement of Section 3 of the U.S. Take It Down Act as effective May 19, 2026. Covered platforms must provide a removal process, and a valid request requires removal of covered content and known identical copies within 48 hours. This is a specific U.S. rule, not a general deadline for every privacy complaint or jurisdiction.
Quick Recap
Choosing between a legal requirement and a framework
| Comparison point | GDPR | NIST Privacy Framework |
|---|---|---|
| What it is | An enforceable legal regime within its scope. | A voluntary, law-agnostic risk-management framework. |
| Who decides applicability | Jurisdiction, organizational role and processing activity determine whether the law applies. | An organization chooses whether and how to use it. |
| What it establishes | Principles, duties and individual rights, including transparency and accountability requirements. | Functions, Profiles and Tiers for structuring risk-management work. |
| Flexibility | Organizations must meet binding requirements while applying them to their circumstances. | Organizations tailor outcomes and maturity to their risks and capacity. |
| Does adoption alone ensure compliance? | Compliance requires meeting the law’s applicable obligations and demonstrating accountability. | No. NIST expressly says use of the Framework does not ensure compliance with laws. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
