Data Security and Privacy
4
Pillars
Access, Encryption, Audit, Response
60
Days
HIPAA breach notification
1
Principle
Least privilege
picture HR data as a castle
Four-Layer Defense
Concentric defenses around HR data. Each ring stops a different attacker. Skip a ring and the attacker walks past it untouched.
Access Control
Role-based perms. MFA. Least privilege. Quarterly reviews.
Encryption
AES-256 at rest and in transit. Key management.
Audit Trails
Logs of access. Required for compliance + investigation.
Breach Response
Detect → contain → assess → notify → remediate.
when the wall comes down
Breach Response — Five Beats
A documented playbook from the moment the alarm goes off. Each step has a clock attached.
Privacy Laws Affecting HR Data
HIPAA
60 daysGroup health plan data — breach notice
CCPA / CPRA
CA onlyEmployee rights to know, delete, correct
GDPR
72 hoursEU employees · DPO · breach notice
BIPA
consent firstIL biometric data · no after-the-fact fix
State breach laws
30-90 daysAll 50 states · varying deadlines
SOX
ongoingPublic-company financial integrity
Exam Traps
Least privilege applies even within HR
Only the minimum access needed for the role. Quarterly access reviews are the audit standard.
State breach deadlines vary
Federal HIPAA gives 60 days. Some states require 30 days or less. The strictest applicable rule controls.
GDPR applies to EU employees regardless of HQ
A US company with EU staff must comply. The exam tests jurisdictional reach.
BIPA requires consent BEFORE collection
After-the-fact consent does not save the violation. Illinois statutory damages are significant.
Strictest rule wins
When multiple deadlines apply (federal HIPAA + state breach laws), the shortest applicable timeline controls.
Need-to-know operating standard
Least privilege is the default. Quarterly access reviews remove permissions for role changes and departures.
Only authorized people get past the gate. Role-based keys. Least privilege. MFA.
Even if attackers get past the wall, the documents are written in cipher.
Logs of who entered, when, and what they touched.
When the wall is breached, raise the bridge, count the loss, notify the village.
Ready to test your PHR knowledge?
1,700+ practice questions written by certified professionals.
Start Practicing PHR