Confidentiality protects information designated confidential against improper access or disclosure. Contracts, organizational classifications, and legal requirements can establish that designation for personal information or nonpersonal business information.
Privacy concerns personal information and the purposes, permissions, rights, and commitments governing its handling throughout its life cycle. Effective privacy controls address inappropriate collection or use even when no outsider accesses the system.
The information and handling determine the relevant category.
- A restricted product formula engages confidentiality even when it identifies no individual.
- Employee bank details engage both confidentiality and privacy because the information is restricted and relates to identifiable people.
- An encrypted customer database used for an undisclosed, impermissible marketing purpose can violate privacy commitments despite effective protection against outside disclosure.
The General Data Protection Regulation (GDPR) addresses qualifying personal-data processing connected with the European Union (EU). A controller determines processing purposes and essential means; a processor handles personal data on the controller's behalf.
The Health Insurance Portability and Accountability Act (HIPAA) establishes confidentiality and privacy requirements for specified health-information relationships.
Common mistakes
- Signature direction reversed. The sender's public key verifies the signature; the recipient's public key serves a different confidential-delivery purpose.
- Masking bypass ignored. A concealed screen field provides little protection when the same user can export its original value.
- Alert mistaken for prevention. A logged upload does not satisfy a requirement to block that upload.
Bottom line
- Confidentiality protects designated information; privacy governs personal-information handling, commitments, and rights.
- Symmetric encryption suits bulk data, asymmetric techniques support key relationships, hashes support integrity comparison, and signatures support origin and integrity verification.
- Masking and tokenization reduce exposure only within their actual access and recovery boundaries; pseudonymized information can remain personal.
- DLP requires effective classification, channel coverage, enforcement settings, and accountable follow-up.
Exam shortcut
Start with the information, actor, purpose, recipient, and applicable commitment. Then select the safeguard that addresses the specific exposure. For cryptography choices, separate secrecy, integrity, origin verification, bulk-data efficiency, and key distribution before evaluating the offered technique. Follow every copy and recovery path. A token, masked display, encrypted disk, or deleted active record can conceal a remaining exposure elsewhere.
The full lesson (about 6,536 words, 44 min read) adds 3 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.C1
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.