Data privacy is the principle that individuals should be able to control how information about them is collected, used, shared and retained, together with the legal rules, organizational practices and technical measures that make this control real. In privacy fundamentals, data privacy is the umbrella concept: it defines what may be done with personal data and why, while security and data protection describe how that data is safeguarded and governed.
The synonym information privacy emphasizes the same idea. Data privacy is not secrecy: personal data may be used legitimately, but only for appropriate purposes, in proportion and with transparency toward the people it describes.
Core principles of data privacy
Most modern privacy frameworks share a common set of principles that trace back to the Fair Information Practice Principles and the OECD privacy guidelines. The EU General Data Protection Regulation states them in their most widely cited form, and many other laws use similar wording.
| Principle | What it requires | Typical practice |
|---|---|---|
| Lawfulness, fairness and transparency | A valid legal basis and clear information | Privacy notices and consent where needed |
| Purpose limitation | Use data only for stated purposes | Purpose registers and review of new uses |
| Data minimization | Collect only what is necessary | Removing optional form fields |
| Accuracy | Keep data correct and up to date | Self-service profile correction |
| Storage limitation | Keep data no longer than needed | Retention schedules and deletion jobs |
| Integrity and confidentiality | Protect data against misuse and loss | Access control and encryption |
| Accountability | Demonstrate compliance | Records, assessments and audits |
These principles apply to personal data, meaning any information relating to an identified or identifiable person. That includes obvious identifiers such as names and email addresses, but also device identifiers, location traces and combinations of attributes that can single out an individual.
Data privacy, data protection and data security
The three terms are often used interchangeably, yet they describe different layers of the same problem. Privacy decides what is appropriate, protection organizes compliance, and security prevents unauthorized access.
| Concept | Central question | Main tools |
|---|---|---|
| Data privacy | Should this data be collected and used this way | Purpose, consent, rights, transparency |
| Data protection | How is personal data governed under the law | Policies, roles, assessments, records |
| Data security | How is data kept safe from threats | Encryption, access control, monitoring |
| Data minimization | Is this data necessary at all | Collection limits and deletion |
The distinction matters in practice. A company can have excellent security and still violate privacy, for example by securely storing data it had no right to collect or by sharing it with a data broker without telling users. Conversely, privacy commitments are meaningless without the security to enforce them.
Roles and rights in data privacy
Privacy law assigns clear roles to the parties that handle personal data. The data subject is the person the data describes. The data controller decides the purposes and means of processing, while the data processor handles data on the controller’s behalf, for example as a cloud or payroll provider.
Data subjects hold enforceable rights under most modern laws, although the exact list varies by jurisdiction.
| Right | What the person can request | Typical response time |
|---|---|---|
| Access | A copy of their data and information about its use | About one month under the GDPR |
| Rectification | Correction of inaccurate data | Without undue delay |
| Erasure | Deletion when there is no reason to keep it | Subject to legal exceptions |
| Objection or opt-out | Stopping certain uses, such as sale or marketing | Promptly, often via a simple control |
| Portability | Data in a reusable format | Applies to data the person provided |
Special rules apply to special category data, such as health, biometric, religious or sexual orientation information, which usually requires a stronger legal basis and additional safeguards.
The legal landscape
Data privacy is regulated differently around the world. The EU follows a comprehensive model: one law covers nearly all processing of personal data. The United States combines sector-specific federal laws, such as rules for health and children’s data, with a growing number of state laws modeled partly on the California Consumer Privacy Act.
- GDPR in the European Union and European Economic Area, with strong rights and fines of up to 4 percent of global annual turnover.
- CCPA, as amended by the CPRA, giving California residents rights to know, delete, correct and opt out of sale or sharing.
- LGPD in Brazil and similar comprehensive laws in many other countries.
- Sector rules such as health privacy laws and children’s online privacy laws.
Laws also restrict international data transfers. Moving personal data to a country without equivalent protection usually requires an adequacy decision, contractual clauses or other approved safeguards.
Putting data privacy into practice
Effective programs follow privacy by design and by default: privacy is considered when a product is planned, and the most protective settings are the starting point. Typical building blocks include a data inventory, records of processing, privacy impact assessments for risky projects, vendor contracts and training.
Common failures are predictable. Organizations collect data just in case it becomes useful, keep it indefinitely, write privacy policies that no user can understand, or rely on consent banners designed to push people toward accepting everything. Regulators increasingly treat such dark patterns as unlawful, and the principles above give a practical test: if a use of data would surprise the person it describes, it probably needs to be reconsidered.
Technical measures support these organizational steps. Pseudonymization, aggregation and access logging reduce the exposure of individuals, while stronger privacy-enhancing technologies such as differential privacy or on-device processing allow useful analysis with less raw personal data. None of them replaces a valid purpose: pseudonymized data generally remains personal data, because it can still be linked back to a person with additional information.
The idea in brief
Data privacy means you get a say in what happens to information about you. When you give a shop your email address, privacy rules decide whether it can only send receipts or also sell your address to others.
Think of it like lending your house key to a neighbor to water the plants. You expect them to water the plants, not to throw a party. Data privacy is about using personal information only for the reason it was shared.
A practical scenario
An online fitness app collects names, emails, workout history and precise location for route tracking. During a privacy review, the team discovers that location data is kept forever and shared with an advertising partner, although the privacy notice mentions only route features.
The company stops the advertising transfer, sets a retention period of 24 months for detailed routes, adds a clear setting that lets users turn location history off and updates its notice in plain language. It also builds a self-service page for access and deletion requests. Complaints decrease, and when a regulator later asks about the app’s practices, the company can show its records and assessments, demonstrating accountability rather than promises.