Privacy & Compliance · Study deck
Privacy Claims Audit
An assessment must connect a design promise to behavior a reviewer can observe.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- turn a stated privacy claim into a test the running system must pass
- spot common privacy anti-patterns and default-setting failures
- apply privacy threat prompts and leave a release-ready assessment record
- Explain: The app changes at once, yet an old job still sends place data to a support store.
Major section
Check the Privacy Claim in the Running System
The app changes at once, yet an old job still sends place data to a support store.
- The assessor must decide whether the promise holds across the device, phone, service, logs, exports, and backups.
- A hidden value or quiet screen is not proof that collection stopped.
Major section
Check the Privacy Claim in the Running System (continued)
Loss of a remote check should not reopen collection or wider sharing.
- This opening does not replace legal review or prove every unseen system.
- Under the Hood examines data paths, threat prompts, removal limits, and the changes that force a new assessment.
- A good test is small enough to run again.
Major section
Check the Privacy Claim in the Running System (continued)
If you only need the intuition, this layer is enough: assessment trusts evidence, not promises.
- If one view and the other do not match, the claim fails.
- This turns a broad claim into work that another reviewer can check.
- The data becomes a liability with no owner and no deletion plan.
Major section
Check the Privacy Claim in the Running System (continued)
Privacy assessment is the act of examining a design or a finished system to find weak or missing privacy controls.
- Foundations tell you what privacy should look like, implementation builds the controls, and assessment is the independent check that the controls actually exist, work, and match what the product claims.
- The reason assessment is a separate discipline is that confident-sounding claims are easy and enforced behavior is hard.
- The Shapes Privacy Failure Takes An anti-pattern is a recurring design choice that looks reasonable but reliably causes a privacy problem.
Major section
Check the Privacy Claim in the Running System (continued)
Collect just in case Gathering data with no current use, hoping it is handy later.
- Off on screen, on in the pipeline A toggle that changes the display but not the behavior, so the protective setting is a label rather than a control.
- If you can tell assessment apart from reciting or building, you have the core idea.
- You do not approve a building because the blueprint has fire exits drawn on it; an inspector walks the building, opens the exit doors, and confirms they actually open onto a safe path.
Major section
Run an Evidence Trail Review
Each one is a question to ask of every data flow.
- A practical assessment turns each privacy claim into a question that can only be answered with evidence, then records the answer.
- Rotate or remove identifiers that are not needed.
- Aggregate or coarsen before the data leaves the device.
- Traffic patterns reveal when someone is home.
Major section
Run an Evidence Trail Review (continued)
The aim is not to score the team; it is to find the gaps between what a system claims and what it does, while there is still time to fix them.
- A log file stores raw readings in plain form.
- Minimize, protect, and scope access to each store.
- Retention runs longer than the notice promises.
Major section
Run an Evidence Trail Review (continued)
If you can turn claims into tests and check the defaults, you can stop here.
- Privacy Threat Prompts Assessors use threat prompts to make sure they look at a system from a privacy attacker's angle, not just a feature angle.
- A finding if any do.
- A finding if raw data is retained just in case.
Major section
Run an Evidence Trail Review (continued)
Default Settings Are Where Assessment Earns Its Keep The single most valuable assessment check is the disabled-state test.
- If a feature still transmits when its switch is off, you have found a protective screen over an unprotected pipeline, which is one of the most common and most serious privacy findings.
- Worked Reasoning: Three Claims, One Method Claim: analytics is off by default Test: capture outbound traffic from a fresh device with analytics off.
- Evidence: a deletion path that reaches all copies, not one table.
Major section
Keep an Audit Record That Survives Release
Impact Assessment, Records, and Failure Modes belong together in one durable review habit.
- The phrase names the ways a claim can quietly stop being true.
- The deeper layer explains how assessment scales from a quick review to a structured process, and why the output has to be durable.
- A deletion path that reaches every copy.
Major section
Keep an Audit Record That Survives Release (continued)
This turns assessment into something a later reviewer or auditor can re-check, rather than a memory that fades.
- A finding that is not written down, with severity and a decision attached, tends to be forgotten by the next release.
- Data feels free and might be useful later.
- Re-assess when data flows change.
Major section
Keep an Audit Record That Survives Release (continued)
For IoT, the trigger is usually large-scale or sensitive sensing, such as continuous monitoring of people in a space, where the impact of getting it wrong is high.
- The Data Protection Impact Assessment When processing is likely to create a high risk to people, data protection practice calls for a structured study before the processing begins.
- The interface is easier to change than the pipeline.
- Deletion is wired to the main table only.
Major section
Keep an Audit Record That Survives Release (continued)
It describes the processing and its purpose, judges whether the data collected is necessary and proportionate to that purpose, identifies the risks to individuals, and sets out the measures that reduce those risks.
- The point of a DPIA is to surface and shrink risk while the design can still change, not to produce a document after launch.
- For each claim, the record should hold the test that was run, the observation, the resulting finding, its severity, and the decision: fixed, accepted with a reason, or blocked.
- The system shipped, then changed, but the review did not.
Deck summary
Key takeaways
The app changes at once, yet an old job still sends place data to a support store.
- Loss of a remote check should not reopen collection or wider sharing.
- If you only need the intuition, this layer is enough: assessment trusts evidence, not promises.
- Privacy assessment is the act of examining a design or a finished system to find weak or missing privacy controls.
- Collect just in case Gathering data with no current use, hoping it is handy later.
Retrieval practice
Recall check 1 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q1Which activity is privacy assessment rather than foundations or implementation?
Show answer
Answer: C Assessment independently checks that the controls exist and work, using evidence rather than claims.
Retrieval practice
Recall check 2 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q2A product claims that location sharing is off by default. What is the strongest way to assess this claim?
Show answer
Answer: A Exercising the disabled state and observing real behavior is evidence; it proves or disproves whether location actually leaves the device.
Retrieval practice
Recall check 3 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q3An assessment finds that account deletion clears the main user table, but raw readings remain in logs and backups. How should this be handled in the assessment record?
Show answer
Answer: D A real deletion path covers all copies; a recorded finding with severity and a decision drives the fix or a conscious acceptance.
Print reference
Answers
Answer key.
- C · Assessment independently checks that the controls exist and work, using evidence rather than claims.
- A · Exercising the disabled state and observing real behavior is evidence; it proves or disproves whether location actually leaves the device.
- D · A real deletion path covers all copies; a recorded finding with severity and a decision drives the fix or a conscious acceptance.