What it means
Privacy asks whether personal information should have been collected, who may use it, how long it may be kept, and what the person can expect. Confidentiality asks a narrower question: who is allowed to read a record that already exists. A file can pass that test and still be used for a purpose the person was never offered.
Security work protects confidentiality, integrity, availability, and the ability to recover. Privacy work asks whether the processing itself fits. NIST SP 800-53 Revision 5 is a catalog of security and privacy controls, useful as shared vocabulary. The catalog does not decide that a statute applies, and this guide does not ask you to implement every control. Sector rules stay in separate explainers. Nothing here is legal advice or a compliance determination.
AN ILLUSTRATIVE SCENARIO
An encrypted driver roster
Riverstone HR holds an encrypted export of driver home addresses and medical-clearance flags so the Oakland dock can be staffed. A vendor asks for the same file to print neighborhood flyers and points at the green encryption setting. The HR owner refuses the copy, keeps access on the named employment role, and asks counsel whether a flyer would be an allowed use. Encryption stayed on. The purpose question went to someone who can answer it.
Put it to work
- Write the purpose that justified collection, the people covered, and the fields that purpose needs. Keep that sentence separate from the control that stops strangers reading the file.
- Limit access to roles that serve the purpose, and keep an audit trail of exports without copying extra sensitive fields into every log line.
- When a long security retention clock and a shorter purpose limit disagree, write the conflict and ask counsel or the privacy officer. Do not close it with a framework map.
How to check your work
For one synthetic export, name one control that serves both security and privacy, one place those goals conflict, and the counsel or privacy officer you would ask. If the note says the file is compliant, rewrite that line as an open question.
Connect the ideas
- Confidentiality
The property that information is available only to people or systems authorized to see it.
- Encryption
Transforming data so only holders of the appropriate key can read it, protecting confidentiality in transit or at rest.
- Audit trail
An append-oriented history of security-relevant actions that can be shown to a later reviewer.
- Data minimization
Collecting, using, and keeping only the personal information a stated purpose needs, and no longer than that purpose requires.