Legal Compliance and Cybersecurity Roles in the Privacy Function

Legal Compliance and Cybersecurity Roles in the Privacy Function (CIPT: Privacy Technologist's Role in the Organization)

Introduction
In the IAPP CIPT (Certified Information Privacy Technologist) body of knowledge, the privacy technologist works with many other functions. Two of the most important partners are Legal/Compliance and Cybersecurity (Information Security). This guide covers four things:
• why these roles matter
• what each role does
• how they work with the privacy technologist
• how to answer exam questions on the topic

1. Why This Topic Is Important
Privacy does not live in one department. A data protection program needs three kinds of input:
• Legal input: what the law requires.
• Security input: how data is protected from unauthorized access.
• Technical input: how systems are actually built and operated.

The privacy technologist sits where these three meet. When the roles are misunderstood, organizations tend to fail in three ways:
• treating privacy as only a security problem (encryption alone does not make processing lawful)
• treating privacy as only a legal problem (policies that are never built into systems)
• creating gaps in accountability, such as no one owning breach notification decisions

Regulators expect demonstrable accountability under GDPR Article 5(2) and Article 24. This makes clear role definitions essential for compliance, audit readiness, and incident response. For the exam, the CIPT checks that you understand who does what, and how the privacy technologist turns legal requirements into technical controls together with security teams.

2. What It Is: Defining the Roles

A. Legal and Compliance Roles
• General Counsel / Legal Team: interprets laws and regulations (GDPR, CCPA/CPRA, HIPAA, GLBA, COPPA, ePrivacy, sector rules). It also drafts and negotiates contracts such as Data Processing Agreements and Standard Contractual Clauses, and advises on lawful basis, cross-border transfers, litigation risk, and regulator interactions.
• Compliance Function: monitors whether the organization follows its legal and policy obligations. It runs compliance assessments, maintains records, tracks regulatory change, and supports audits. It often reports to a Chief Compliance Officer.
• Data Protection Officer (DPO): required under GDPR in certain cases (public authorities, large-scale systematic monitoring, large-scale special category data).
  - Tasks: informs and advises, monitors compliance, advises on DPIAs, and acts as contact point for supervisory authorities.
  - Must be independent, must not receive instructions on how to perform their tasks, and must have no conflict of interest.
  - Example: a CISO or Head of IT often cannot also be the DPO, because they decide the means of processing.
• Chief Privacy Officer (CPO): a strategic leader of the privacy program. The CPO is often in Legal or Compliance, though sometimes standalone. The CPO sets policy, governance, and culture.
• Internal Audit: independently evaluates whether privacy and security controls are designed and operating effectively. This is the third line of defense.

B. Cybersecurity Roles
• Chief Information Security Officer (CISO): owns the information security strategy, risk management, security architecture, and incident response capability.
• Security Operations Center (SOC) / Security Analysts: monitor, detect, and respond to threats. They manage SIEM tools, logging, and alerting.
• Security Architects and Engineers: design and implement controls such as encryption, identity and access management (IAM), network segmentation, DLP, and endpoint protection.
• Incident Response Team (CSIRT): handles containment, eradication, recovery, and forensic investigation of security incidents.
• Governance, Risk and Compliance (GRC) Security staff: map controls to frameworks such as ISO/IEC 27001/27002, NIST CSF, NIST SP 800-53, SOC 2, and PCI DSS.

C. The Privacy Technologist
The privacy technologist is the bridge between legal requirements and technical implementation. Typical tasks include:
• implementing Privacy by Design and by Default
• supporting Privacy Impact Assessments and DPIAs from a technical perspective
• designing data minimization, retention, and deletion mechanisms
• implementing consent and preference management
• applying de-identification, pseudonymization, and anonymization techniques
• enabling data subject rights (access, deletion, portability)
• working with security to ensure appropriate safeguards

3. How It Works: Interaction Between the Roles

Privacy vs. Security: Overlap and Difference
Security protects all information assets, including trade secrets and financial data, mainly through Confidentiality, Integrity, Availability (CIA). Privacy concerns personal information and the appropriate collection, use, sharing, and retention of it. This rests on Fair Information Practice Principles (FIPPs) such as purpose limitation, transparency, choice, and individual participation.

A common phrase: You can have security without privacy, but you cannot have privacy without security. Example: a perfectly secure database that collects data without a lawful basis, or uses it for undisclosed purposes, still violates privacy.

The NIST Privacy Framework shows this as a Venn diagram:
• Cybersecurity risks come from loss of CIA.
• Privacy risks come from data processing itself, even when it is authorized.
• The overlap is cybersecurity-related privacy events, such as data breaches.

Translating Law into Controls (Typical Workflow)
1. Legal identifies a requirement. Example: GDPR Article 17 right to erasure, or Article 32 security of processing.
2. Compliance or the Privacy Office turns it into policy and standards. Example: a retention schedule.
3. The privacy technologist designs technical implementations. Example: automated deletion jobs, data inventory tagging, deletion propagation to backups and processors.
4. Security implements and monitors protective controls. Example: encryption, access logging, IAM.
5. Internal Audit or Compliance verifies effectiveness.

Three Lines of Defense Model
• First line: business and IT operations, including engineers and product teams, who own and manage risk.
• Second line: risk management, compliance, privacy office, and security GRC, who oversee and set frameworks.
• Third line: internal audit, which provides independent assurance.

Data Breach / Incident Response Collaboration
• Security (CSIRT/SOC): detects, contains, investigates the technical scope, and preserves forensic evidence.
• Privacy technologist / Privacy Office: determines whether personal data was involved, which data elements, how many individuals, and the risk of harm.
• Legal: decides on notification obligations (GDPR 72 hours to the supervisory authority; individuals without undue delay if high risk; US state breach laws; HIPAA 60 days). Legal also manages attorney-client privilege, regulators, and law enforcement.
• Others involved: communications/PR, customer service, executives, and sometimes HR.
• Key concept: a security incident is not always a privacy breach. Legal and privacy decide whether a notifiable breach occurred.

Vendor / Third-Party Management
• Legal negotiates DPAs and contractual clauses.
• Security performs security assessments (questionnaires, SOC 2 reports, penetration test evidence).
• The privacy technologist assesses data flows, minimization, sub-processors, and technical transfer safeguards.

DPIAs and Privacy by Design
• Legal and the DPO advise on necessity, proportionality, and lawful basis.
• Security contributes threat models and control recommendations.
• The privacy technologist maps data flows, identifies privacy risks such as linkability, identifiability, and surveillance, and proposes privacy-enhancing technologies (PETs).

Common Frameworks and Standards
• ISO/IEC 27001: information security management system (ISMS).
• ISO/IEC 27701: privacy extension to 27001 (PIMS), which integrates the two.
• NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, Recover (plus Govern in CSF 2.0).
• NIST Privacy Framework: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P.
• GDPR Article 32: appropriate technical and organizational measures, including pseudonymization, encryption, resilience, and regular testing.
• GDPR Article 25: Data Protection by Design and by Default.

Reporting Lines and Conflicts of Interest
• Privacy may report to Legal, Compliance, IT/Security, or directly to the CEO or Board. Each option has tradeoffs:
  - reporting to Legal gives regulatory focus but may lack technical depth
  - reporting to Security gives technical strength but may reduce privacy to a CIA view
• The DPO must report to the highest management level and remain independent.
• Separation of duties matters. Those who build controls should not be the only ones assessing them.

4. Exam Tips: Answering Questions on Legal Compliance and Cybersecurity Roles in the Privacy Function

Tip 1: Identify which function owns the decision.
• Interpreting a law, deciding notification, or negotiating a contract points to Legal.
• Detecting, containing, or implementing encryption and IAM points to Security.
• Turning privacy requirements into system design (minimization, deletion, consent, de-identification) points to the Privacy Technologist.
• Independent verification points to Internal Audit.

Tip 2: Remember that privacy is broader than security.
Some answers suggest that encryption or access controls alone satisfy privacy. These are usually wrong when the scenario involves purpose limitation, consent, transparency, or retention. Look for the answer that addresses appropriate use, not just protection.

Tip 3: Favor collaboration and early involvement.
CIPT questions often reward answers that involve the right stakeholders early (Privacy by Design) and cross-functionally. Answers where one team acts alone, or where privacy is added after deployment, are usually distractors.

Tip 4: Watch for DPO independence and conflicts.
If a scenario proposes making the CISO, CIO, or Head of Marketing the DPO, recognize the potential conflict of interest. The DPO advises and monitors. The DPO does not make processing decisions and is not personally liable for compliance; the controller is.

Tip 5: Distinguish incident from breach.
In incident response questions, the usual correct sequence is:
• Security contains and investigates.
• Privacy assesses the personal data impact and risk to individuals.
• Legal determines the notification duty and timing.
Do not assume every incident needs notification. Also know the key timeframes, such as GDPR 72 hours to the authority.

Tip 6: Know the frameworks' purposes.
• ISO 27001 covers security.
• ISO 27701 covers privacy built on 27001.
• NIST CSF covers cybersecurity risk.
• NIST Privacy Framework covers privacy risk, including risks from authorized processing.
Questions may ask which framework best helps integrate privacy and security programs. That answer is often ISO 27701 or the NIST Privacy Framework used with the CSF.

Tip 7: Look for the best answer, not just a correct answer.
Several options may be partially right. Choose the one that:
• is most proactive
• is risk-based
• addresses root cause
• aligns with accountability and documented governance

Tip 8: Translate legal language into technical action.
The CIPT is a technologist exam. When a question cites a legal requirement, the correct answer is often the technical control that implements it. Examples:
• right to erasure: deletion workflows plus a data inventory
• data minimization: collect only the fields needed, and use field-level suppression
• security of processing: encryption, pseudonymization, and testing

Tip 9: Remember the three lines of defense.
If asked who provides independent assurance, the answer is Internal Audit, not Compliance or Security.

Tip 10: Read scenario details carefully.
Keywords such as first step, most appropriate, primary responsibility, or best describes change the answer. For a first step, prefer:
• understanding the data (inventory or mapping)
• engaging the appropriate stakeholder
over jumping to a technical fix.

Sample Question Walkthrough
Question: A company's SOC detects unauthorized access to a customer database. Who should determine whether regulators must be notified?
A) The SOC analyst
B) The CISO
C) Legal counsel in consultation with the privacy office
D) The database administrator

Answer: C. Security detects and contains the incident. Legal, informed by the privacy assessment of data types and risk of harm, determines the notification obligation.

Summary
• Legal and Compliance define and monitor what must be done.
• Cybersecurity protects information through CIA-focused controls.
• The privacy technologist translates privacy requirements into system design and works with both teams.
• Successful programs integrate these roles through governance, frameworks such as ISO 27701 and the NIST Privacy Framework, DPIAs, vendor management, and coordinated incident response.

On the exam, focus on three things: role ownership, the difference between privacy and security, early cross-functional collaboration, and turning legal obligations into concrete technical controls.