Data Protection Skill
Purpose
Defines data protection practices ensuring privacy-by-design, GDPR compliance, and secure data handling across all Hack23 projects.
Data Classification Levels
| Level | Description | Handling |
|---|---|---|
| PUBLIC | Open data, published information | No restrictions |
| INTERNAL | Operational data, system metadata | Access controlled |
| CONFIDENTIAL | Personal data, business sensitive | Encrypted, logged |
| RESTRICTED | Credentials, keys, PII aggregation | Encrypted, MFA required |
Privacy-by-Design Principles
- Proactive — Prevent privacy issues before they occur
- Default — Maximum privacy as default setting
- Embedded — Privacy built into design
- Positive-Sum — Privacy AND functionality
- End-to-End — Full lifecycle protection
- Transparency — Open and documented
- User-Centric — Respect user privacy
GDPR Requirements
- Lawful basis for processing
- Data minimization (collect only what's needed)
- Purpose limitation
- Storage limitation (retention policies)
- Data subject rights (access, deletion, portability)
- Privacy impact assessments for new features
Static Site Considerations
- No cookies without consent
- Privacy-preserving analytics only
- No tracking pixels or fingerprinting
- Secure external links (rel="noopener noreferrer")
- No PII in URLs or query parameters
ISO 27001 Mapping
- A.5.34 — Privacy and protection of PII
- A.8.11 — Data masking
- A.8.12 — Data leakage prevention