Building Effective Privacy Programs

Cybersecurity from Principles to Practice
1. Auflage 2025
ISBN: 978-1-394-34263-1
Verlag: John Wiley & Sons Inc

Buch, Englisch, 448 Seiten, Format (B × H): 225 mm x 284 mm, Gewicht: 1366 g

Presents a structured approach to privacy management, an indispensable resource for safeguarding data in an ever-evolving digital landscape

In today’s data-driven world, protecting personal information has become a critical priority for organizations of all sizes. Building Effective Privacy Programs: Cybersecurity from Principles to Practice equips professionals with the tools and knowledge to design, implement, and sustain robust privacy programs. Seamlessly integrating foundational principles, advanced privacy concepts, and actionable strategies, this practical guide serves as a detailed roadmap for navigating the complex landscape of data privacy.

Bridging the gap between theoretical concepts and practical implementation, Building Effective Privacy Programs combines in-depth analysis with practical insights, offering step-by-step instructions on building privacy-by-design frameworks, conducting privacy impact assessments, and managing compliance with global regulations. In-depth chapters feature real-world case studies and examples that illustrate the application of privacy practices in a variety of scenarios, complemented by discussions of emerging trends such as artificial intelligence, blockchain, IoT, and more.

Providing timely and comprehensive coverage of privacy principles, regulatory compliance, and actionable strategies, Building Effective Privacy Programs: - Addresses all essential areas of cyberprivacy, from foundational principles to advanced topics
- Presents detailed analysis of major laws, such as GDPR, CCPA, and HIPAA, and their practical implications
- Offers strategies to integrate privacy principles into business processes and IT systems
- Covers industry-specific applications for healthcare, finance, and technology sectors
- Highlights successful privacy program implementations and lessons learned from enforcement actions
- Includes glossaries, comparison charts, sample policies, and additional resources for quick reference

Written by seasoned professionals with deep expertise in privacy law, cybersecurity, and data protection, Building Effective Privacy Programs: Cybersecurity from Principles to Practice is a vital reference for privacy officers, legal advisors, IT professionals, and business executives responsible for data governance and regulatory compliance. It is also an excellent textbook for advanced courses in cybersecurity, information systems, business law, and business management.

Autoren/Hrsg.

Weaver, Griffin

Edwards, Jason

Fachgebiete

• Technische Wissenschaften Technik Allgemein Technische Zuverlässigkeit, Sicherheitstechnik
• Rechtswissenschaften Strafrecht
• Technische Wissenschaften Elektronik | Nachrichtentechnik Nachrichten- und Kommunikationstechnik
• Mathematik | Informatik EDV | Informatik Technische Informatik Computersicherheit Computerkriminalität & Hacking

Inhaltsverzeichnis

Preface xi

Acknowledgement xiii

1 Introduction to Privacy 1

Definition and Importance of Privacy 1

Historical Perspective on Privacy 5

Modern Privacy Challenges 10

Recommendations 16

Chapter Conclusion 17

Questions 17

2 Understanding Personal Data 21

Definition and Types of Personal Data 21

Sensitive Personal Data 27

Data Combinations and Anonymization 32

Recommendations 37

Chapter Conclusion 38

Questions 38

3 Data Processing 41

Definition and Types of Processing 42

Legal Bases for Processing 48

Data Processing Principles 54

Recommendations 60

Chapter Conclusion 60

Questions 61

4 Roles and Relationships 65

Data Controller vs. Data Processor 65

Subprocessors 75

Data Subjects and Their Rights 80

Recommendations 84

Chapter Conclusion 85

Questions 86

5 Privacy Impact Assessments 89

Purpose and Benefits of PIA 89

Conducting a PIA 94

Example of PIA 96

PIA Templates and Examples 101

Recommendations 107

Chapter Conclusion 108

Questions 109

6 Roles in Privacy Leadership 113

Chief Privacy Officer 113

Chief Information Security Officer 116

Data Protection Officer 118

Privacy Champions 121

Privacy Engineers 123

Recommendations 127

Chapter Conclusion 129

Questions 129

7 Data Subject Rights 133

Foundational Frameworks 133

Handling Data Subject Requests 140

DSR Tools and Techniques 145

Recommendations 151

Chapter Conclusion 152

Questions 152

8 Privacy Frameworks and Standards 157

NIST Privacy Framework: Mapping Organizational Practices to the Framework 157

Iso/iec 27701 160

Other Notable Frameworks: GDPR, CCPA, PIPL, and LGPD 166

Recommendations 172

Chapter Conclusion 173

Questions 174

9 Major Privacy Laws and Regulations 177

Laws and Regulations 177

California Consumer Privacy Act 185

Health Insurance Portability and Accountability Act 190

Comparative Analysis of Global Regulations 198

Recommendations 200

Chapter Conclusion 201

Questions 202

10 International Privacy Concerns 205

Cross-Border Data Transfers 205

Adequacy Decisions 213

BCRs and SCCs 218

Recommendations 223

Chapter Conclusion 224

Questions 225

11 Regulatory Enforcement 229

Role of DPAs 229

Case Studies of Regulatory Actions 240

Recommendations 244

Chapter Conclusion 246

Questions 246

12 Privacy by Design and Default 251

Principles of Privacy by Design 251

Implementing Privacy by Default 255

Case Studies and Best Practices 258

Recommendations 262

Chapter Conclusion 263

Questions 263

13 Privacy Technology and Tools 267

PETs: Anonymization vs. Pseudonymization 267

Data Masking and Encryption 270

Privacy Management Software 275

Recommendations 278

Chapter Conclusion 280

Questions 280

14 Data Breach Management 283

Identifying and Responding to Data Breaches 283

Notification Requirements 288

Postbreach Remediation 292

Recommendations 296

Chapter Conclusion 298

Questions 298

15 Emerging Privacy Trends 301

AI and Privacy 301

IoT and Privacy 305

Blockchain and Privacy 310

Recommendations 315

Chapter Conclusion 316

Questions 317

16 Privacy Program Implementation 321

Establishing a Privacy Governance Structure 321

Developing Privacy Policies and Procedures 326

Implementing Privacy Controls and Measures 333

Monitoring and Reporting on Privacy Compliance 339

Continuous Improvement of the Privacy Program 346

Recommendations 354

Chapter Conclusion 355

Questions 356

17 Privacy Training and Awareness 359

Developing Effective Privacy Training Programs 359

Engaging Employees in Privacy Awareness 364

Training Tools and Resources 368

Sample Annual Privacy Training Plan 369

Recommendations 372

Chapter Conclusion 373

Questions 373

18 Privacy Audits and Assessments 377

Essential Program Components 377

Using Assessment Tools 382

Integrating Assessments with Risk Management 385

Reporting and Follow-Up Actions 387

Recommendations 389

Chapter Conclusion 390

Questions 390

Answers 395

Index 421

Über Autor(innen)

Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges. His career includes leadership roles across the military, insurance, finance, energy, and technology industries. He is a husband, father, former military cyber officer, adjunct professor, avid reader, dog dad, and popular on LinkedIn.

Griffin Weaver is the Managing Legal Director (Privacy, Cybersecurity, and Technology) at Dell Technologies. He holds a Juris Doctorate and is a Fellow of Information Privacy (FIP). Weaver specializes in digital law, privacy governance, and cybersecurity policy. He is a sought-after speaker and educator who has taught privacy and cybersecurity law at leading institutions, regularly contributes to industry publications, and presents at global conferences on privacy, data protection, and digital rights.