Welcome to Confidentiality and Privacy!

Welcome, future CPAs! You’ve reached a critical part of the Information Systems and Controls (ISC) exam. While "Security" is often about keeping the bad guys out, Confidentiality and Privacy are about how we handle the sensitive information we already have inside. Think of it as the difference between locking your front door (Security) and making sure you don't whisper your best friend's secrets to the neighbors (Confidentiality/Privacy).

In this chapter, we will explore why these concepts are the bedrock of trust in business and how companies protect data from the moment they collect it until the moment they delete it. Don't worry if these terms seem similar at first—we're going to break them down step-by-step!

1. Confidentiality vs. Privacy: What’s the Difference?

Many students find these two terms confusing because they overlap. Here is the easiest way to tell them apart:

Confidentiality protects information designated confidential, including business secrets AND personal information. Privacy governs personal information throughout collection, use, retention, disclosure and disposal in line with applicable commitments and requirements. These categories overlap: a customer’s account information can be both confidential and subject to privacy controls.

Confidentiality protects information designated confidential, including business secrets AND personal information. Privacy governs personal information throughout collection, use, retention, disclosure and disposal in line with applicable commitments and requirements. These categories overlap: a customer’s account information can be both confidential and subject to privacy controls.

Confidentiality protects information designated confidential, including business secrets AND personal information. Privacy governs personal information throughout collection, use, retention, disclosure and disposal in line with applicable commitments and requirements. These categories overlap: a customer’s account information can be both confidential and subject to privacy controls.

Quick Review:
  • Confidentiality protects information designated confidential, including business secrets AND personal information. Privacy governs personal information throughout collection, use, retention, disclosure and disposal in line with applicable commitments and requirements. These categories overlap: a customer’s account information can be both confidential and subject to privacy controls.

Confidentiality protects information designated confidential, including business secrets AND personal information. Privacy governs personal information throughout collection, use, retention, disclosure and disposal in line with applicable commitments and requirements. These categories overlap: a customer’s account information can be both confidential and subject to privacy controls.

2. Protecting Confidentiality

To keep a company's secrets safe, we need specific controls. Here are the most common ones you'll see on the ISC exam:

Encryption

Encryption is the process of scrambling data so that it can only be read by someone with the "key." For the exam, remember these two states of data:

  • Encrypt stored data with suitable encryption and key management; protect data in transit with current, securely configured TLS. SSL is obsolete and should not be recommended. Encryption does not replace authorization, access control or secure key handling.

Access Controls

Not everyone in a company needs to see everything. We use the Principle of Least Privilege, which means giving employees only the access they need to do their jobs—and nothing more.

Training and Policy

Often, the "human element" is the weakest link. Non-Disclosure Agreements (NDAs) are legal contracts that stop employees or partners from sharing secrets. Training helps employees recognize Social Engineering (like a fake phone call) where someone tries to trick them into giving up confidential info.

Did you know? Many data breaches happen not because of a genius hacker, but because someone left a confidential report on a printer or used "Password123" as their login!

3. Privacy: Protecting Personal Information

Privacy is a huge deal for CPAs because of the legal risks involved. To understand privacy, we first need to identify what we are protecting:

PII and PHI

  • PII is information that identifies or can be linked to an individual. HIPAA PHI is individually identifiable health information maintained or transmitted by a covered entity or business associate, subject to statutory exclusions (including certain employment and education records). Health-related data is not automatically HIPAA PHI merely because it concerns a person.

Privacy frameworks: current TSC and historical GAPP

The older GAPP framework has ten principles: management; notice; choice/consent; collection; use/retention/disposal; access; third-party disclosure; security; quality; monitoring/enforcement. Treat this as historical background. Current SOC privacy criteria use the AICPA Trust Services Criteria, with privacy areas P1–P8 covering notice, choice/consent, collection, use/retention/disposal, access, disclosure/notification, quality, and monitoring/enforcement. Apply relevant common criteria too. Consent and individual rights depend on applicable law and commitments; consent is not universally the only lawful basis.

  1. The older GAPP framework has ten principles: management; notice; choice/consent; collection; use/retention/disposal; access; third-party disclosure; security; quality; monitoring/enforcement. Treat this as historical background. Current SOC privacy criteria use the AICPA Trust Services Criteria, with privacy areas P1–P8 covering notice, choice/consent, collection, use/retention/disposal, access, disclosure/notification, quality, and monitoring/enforcement. Apply relevant common criteria too. Consent and individual rights depend on applicable law and commitments; consent is not universally the only lawful basis.

Notice explains the personal data collected and its purposes; choice/consent addresses the choices and consent required by applicable law and commitments; access provides the applicable means to review and correct personal information. These are part of historical GAPP and also appear in current TSC privacy criteria. They are not the complete privacy framework, and consent is not required as the sole lawful basis for every processing activity.

4. The Data Lifecycle

Data doesn't just sit there; it moves through a "life." Understanding this cycle helps you identify where controls are needed.

Step 1: Collection – Gathering the data. (Is it necessary? Did we give notice?)

Step 2: Storage – Keeping the data safe. (Is it encrypted at rest?)

Step 3: Usage – Using the data for business. (Are we only using it for the reason we told the customer?)

Step 4: Sharing – Giving data to partners. (Do they have a contract to keep it safe?)

Retain information only for justified business, legal and contractual purposes. Excess retention increases exposure and breach impact; deleting too early can violate retention duties or legal holds. A retention schedule should define required periods and secure disposal, with exceptions documented.

Step 6: Destruction – Getting rid of the data. (Did we shred the papers or wipe the hard drive properly?)

Deleting a file may leave recoverable data. Choose a validated clear, purge or destroy method appropriate to the medium and sensitivity, and verify the outcome under NIST guidance. Repeated overwriting is not a universal solution, particularly for SSDs; eligible cryptographic erase may be suitable. Observe retention requirements and legal holds before disposal.

Key Takeaway: Privacy and confidentiality must be managed at every single stage of this lifecycle, not just at the beginning.

5. Summary and Quick Review

Don't let the technical jargon scare you. At its heart, this chapter is about trust. As a CPA, you ensure that organizations keep their secrets and respect their customers' personal lives.

Quick Review Box:
  • Confidentiality protects information designated confidential, including business secrets AND personal information. Privacy governs personal information throughout collection, use, retention, disclosure and disposal in line with applicable commitments and requirements. These categories overlap: a customer’s account information can be both confidential and subject to privacy controls. Encrypt stored data with suitable encryption and key management; protect data in transit with current, securely configured TLS. SSL is obsolete and should not be recommended. Encryption does not replace authorization, access control or secure key handling. The older GAPP framework has ten principles: management; notice; choice/consent; collection; use/retention/disposal; access; third-party disclosure; security; quality; monitoring/enforcement. Treat this as historical background. Current SOC privacy criteria use the AICPA Trust Services Criteria, with privacy areas P1–P8 covering notice, choice/consent, collection, use/retention/disposal, access, disclosure/notification, quality, and monitoring/enforcement. Apply relevant common criteria too. Consent and individual rights depend on applicable law and commitments; consent is not universally the only lawful basis.

Final Encouragement: You’re doing great! This section of the ISC exam is very logical once you realize it's all about minimizing risk. Keep practicing these definitions, and they will become second nature!