Roadmaps Security roadmaps Information security and data protection
Build systems that collect less, protect what they hold, honour people's rights over their data, and meet privacy law by design rather than after the fact.
Estimated time: 15–26 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Purpose limitation, data minimisation, accuracy, storage limits, security and accountability underlie most privacy law. Learn the principles and the rest follows.
Personal data is broader than names: it includes identifiers, location, device IDs and anything that can single someone out. Special categories need extra care.
Know the shape of GDPR, CCPA/CPRA and the sectoral laws that apply to you. You need the principles and duties, not every clause.
Document what personal data you hold, why, where it flows and how long you keep it. The record of processing is the backbone of a privacy programme.
Every use of personal data needs a reason the law accepts. Consent is only one option and has strict rules; understand the alternatives.
Tell people plainly what you collect, why, who you share it with and their rights. Clear notices are a legal duty and a trust builder.
Build privacy into designs from the start and set the most protective option as the default. It is both good practice and a legal expectation.
A DPIA works through what could go wrong for people from a new processing activity and how to reduce it. Run it early, when you can still change the design.
People can ask to see, correct, delete and port their data. Build the processes and the system support to answer within the legal deadlines.
Capture, store and honour consent and preferences, and make withdrawing as easy as giving. Cookie and tracking consent is a common pitfall.
Pseudonymisation replaces identifiers but data can still be re-linked; true anonymisation is hard and, when done, takes data out of scope. Know the difference.
When you share personal data with processors and partners, contracts and checks must carry the duties with it. Cross-border transfers need extra safeguards.
Add carefully calibrated noise so you can publish statistics without exposing individuals. Powerful but easy to misapply; understand the privacy budget.
Secure multiparty computation, federated learning and synthetic data let you use data while revealing less. Know what each is good and bad at.
Encryption and key separation limit who can read personal data, including your own staff and processors. It supports, but does not replace, the other controls.
Models can memorise and leak training data. Combine minimisation, differential privacy and access controls when personal data trains a model.
Privacy breaches have tight notification deadlines and specific duties to regulators and people. Fold these into incident response ahead of time.
At scale, data mapping, rights requests and retention need tooling, not spreadsheets. Automate discovery, deletion and consent where you can.
Tie together policy, assessments, rights, training and tooling into a programme the business can live with, and show the regulator you did.
Most privacy failures are everyday choices by people who were not thinking about privacy. Build awareness and make the right thing the easy thing.
Track assessment coverage, rights-request timeliness, retention compliance and incidents. Report risk and trust, not activity.
Privacy engineering turns privacy principles and laws into the way systems are actually built: collecting only what is needed, keeping it only as long as needed, protecting it, and letting people see, correct and delete their own data.
The work ranges from writing privacy into designs and running impact assessments to applying privacy-enhancing technologies such as anonymisation, pseudonymisation and differential privacy. It sits between legal, product and security teams and needs a bit of all three.
Privacy law now carries real fines and real engineering requirements. Products need people who can meet those requirements without grinding development to a halt, and who can build privacy in rather than bolting it on.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact