THE SHORT ANSWER
Cybersecurity protects systems and information from unauthorized access, alteration, disruption or loss. Data privacy governs the purpose, collection, use, sharing, access, retention and deletion of personal information. Strong security supports privacy, but security alone does not make data use appropriate.
Security and privacy overlap without becoming identical
| Question | Cybersecurity | Data privacy |
|---|---|---|
| Primary concern | Protection and resilience | Appropriate handling of personal information |
| Typical decision | Who can access this system? | Should this information be collected or used? |
| Failure example | Account compromise | Unexpected or excessive data use |
One failure can affect both
Exposed customer data is a security incident and a privacy harm. Conversely, perfectly secured information can still be retained too long or used beyond a reasonable stated purpose.
Use both lenses
- Define the business purpose.
- Collect the minimum appropriate information.
- Restrict and review access.
- Explain relevant use and choices.
- Set retention and deletion rules.
- Prepare for exposure or loss.
Turn guidance into an owned business action
Choose one relevant account, system, data set or workflow. Record the owner, current control, most important failure, detection signal, response step and recovery dependency. Escalate specialist, legal or regulatory questions to qualified advisers for the applicable context.
Sources & further reading
- The NIST Cybersecurity Framework 2.0
National Institute of Standards and Technology. Current outcome-based guidance for governing, identifying, protecting, detecting, responding to and recovering from cybersecurity risk. It does not prescribe one implementation.
- Direct marketing guidance
UK Information Commissioner's Office. UK regulatory guidance on planning, collecting information, transparency and respecting communication preferences, checked 28 September 2026. Requirements vary by jurisdiction and context; this is not individual legal advice.
Examples and exercises are illustrative unless attributed to a source. No independent expert review is claimed.
A correction, a counterexample or an experience worth sharing?
Join the conversation ↗