Learn privacy engineering tooling vocabulary: BigID PII scanning, data catalog with privacy classification, consent management platforms, privacy tests in CI, privacy design reviews — language for modern privacy engineering practice.
0 / 14 completed
1 / 14
The privacy team says: 'We use BigID to scan for PII across our data stores.' What is BigID and what does 'scanning for PII' mean?
BigID is a data intelligence and privacy management platform. It connects to data stores (databases, data lakes, file shares, cloud storage) and uses machine learning and pattern matching to automatically discover and classify personal data (PII such as names, emails, passport numbers, health data). Knowing where PII exists is a prerequisite for GDPR compliance, data subject request fulfilment, and breach impact assessment.
2 / 14
The data governance team explains: 'We use a data catalog with privacy classification to track all personal data assets.' What is a data catalog in a privacy context?
A data catalog (tools like Collibra, Alation, DataHub, or Amundsen) is an organised inventory of an organisation's data assets with rich metadata. In a privacy engineering context, the catalog includes privacy-relevant metadata: which tables contain PII, what type of PII (name, health data, financial data), who is the data owner, what is the retention period, and what is the privacy classification (public, internal, confidential, highly confidential). This enables systematic data governance and privacy compliance.
3 / 14
The frontend developer says: 'The CMP stores consent records for each user.' What is a CMP?
A CMP (Consent Management Platform) is a technology solution that presents consent choices to users (typically via a cookie banner or privacy preference centre), captures their selections, stores a timestamped record of each user's consent, and signals those preferences to analytics, advertising, and tracking systems. Under GDPR and ePrivacy regulations, organisations must obtain valid consent for non-essential cookies and tracking. Consent records must be auditable.
4 / 14
The CI pipeline configuration includes: 'privacy-test: scan application logs for PII patterns.' What is the purpose of a privacy test in CI?
A privacy test in CI automatically scans code artefacts — log outputs, API response samples, error messages — for patterns indicating PII (email addresses, names, national ID numbers, payment card numbers). Logging PII accidentally (e.g., logging a full request body that contains a password or email) is a common privacy violation. Catching it in CI before deployment prevents PII from being stored in production logs where it should not be.
5 / 14
The engineering manager says: 'The privacy review is part of the design process — any feature handling personal data goes through it before development starts.' What is the purpose of a privacy review at design time?
A privacy review (sometimes called a Privacy Impact Assessment or Data Protection Impact Assessment, DPIA) evaluates a new feature or system at the design stage before development begins. It identifies: what personal data is collected and why, the lawful basis, potential privacy risks, data minimisation opportunities, retention periods, security controls, and third-party data sharing. Catching privacy issues at design time is far cheaper and more effective than retrofitting compliance after the system is built.
6 / 14
PR Description:
"Fix: Updated user profile API endpoint to include a new 'birthdate' field. This is for improved analytics reporting on user demographics. The data will be stored in PostgreSQL."
The core issue here isn't just about 'storing birthdates,' but the lack of consideration for privacy engineering principles. Option A incorrectly assumes anonymization solves all problems – hashing and pseudonymization are often required. Option B correctly identifies the risk of storing raw data and suggests a more secure approach, directly addressing the prompt's focus on tooling vocabulary within a code review context. Options C and D demonstrate a misunderstanding of the potential legal and ethical implications of handling PII.
7 / 14
PR Description:
"Fix: Updated user profile API endpoint to include a new 'birthdate' field. This is for improved analytics reporting on user demographics. The data will be stored in PostgreSQL."
The core issue here isn't just about 'storing birthdates,' but the lack of consideration for privacy engineering principles. Option A incorrectly assumes anonymization solves all problems – hashing and pseudonymization are often required. Option B correctly identifies the risk of storing raw data and suggests a more secure approach, directly addressing the prompt's focus on tooling vocabulary within a code review context. Options C and D demonstrate a misunderstanding of the potential legal and ethical implications of handling PII.
8 / 14
PR Description:
"Fix: Updated user profile API endpoint to include a new 'birthdate' field. This is for improved analytics reporting on user demographics. The data will be stored in PostgreSQL."
The core issue here isn't just about 'storing birthdates,' but the lack of consideration for privacy engineering principles. Option A incorrectly assumes anonymization solves all problems – hashing and pseudonymization are often required. Option B correctly identifies the risk of storing raw data and suggests a more secure approach, directly addressing the prompt's focus on tooling vocabulary within a code review context. Options C and D demonstrate a misunderstanding of the potential legal and ethical implications of handling PII.
9 / 14
PR Description:
"Fix: Updated user profile API endpoint to include a new 'birthdate' field. This is for improved analytics reporting on user demographics. The data will be stored in PostgreSQL."
The core issue here isn't just about 'storing birthdates,' but the lack of consideration for privacy engineering principles. Option A incorrectly assumes anonymization solves all problems – hashing and pseudonymization are often required. Option B correctly identifies the risk of storing raw data and suggests a more secure approach, directly addressing the prompt's focus on tooling vocabulary within a code review context. Options C and D demonstrate a misunderstanding of the potential legal and ethical implications of handling PII.
10 / 14
During a standup meeting, Sarah (the Lead Developer) says: 'We're using PrivaLens to automatically identify and redact sensitive data in our logs before they're sent to Elasticsearch.' What is PrivaLens likely doing? PrivaLens is a synthetic data generation tool.
PrivaLens, in this context, is almost certainly performing data redaction. Elasticsearch indexes logs containing PII; without redaction, this poses a significant risk. The tool is proactively mitigating that risk by removing sensitive content before indexing, ensuring compliance and reducing potential breaches. Option A describes synthetic test data, while options B and D are unrelated to log management.
11 / 14
A Slack message from the security team reads: 'We've implemented a DLP (Data Loss Prevention) rule that blocks outbound transfers of CSV files containing PII to unapproved cloud storage services.' What does 'DLP' stand for in this scenario, and what is its primary function? DLP stands for Data Loss Prevention
The term 'DLP' in this message clearly refers to Data Loss Prevention. DLP systems are specifically built to identify and block the *unauthorized* transfer of sensitive data – in this case, PII-containing CSV files – preventing a potential security breach. Options A, B, and C describe different technologies or frameworks, not the core function of DLP.
12 / 14
During code review, David (the Security Engineer) comments on a PR: 'This API endpoint returns user data including email addresses and phone numbers. Consider adding a pseudonymization layer to protect these values.' What does 'pseudonymization' refer to in the context of this comment? Pseudonymization replaces identifiable information with aliases
Pseudonymization is a critical privacy technique. It involves replacing direct identifiers (like email addresses) with unique, irreversible codes – pseudonyms – which allows you to process the data without revealing the original individual's identity. This reduces risk while still allowing for analysis and reporting, unlike options A, B, C and D which represent different data protection approaches.
13 / 14
A developer submits a PR with the following description: 'Implemented new GDPR compliance checks in our CI pipeline using PrivacyGuard. It automatically flags any code that uses personally identifiable information without proper consent.' What is 'PrivacyGuard' likely to be? PrivacyGuard is a privacy compliance tool
In this scenario, 'PrivacyGuard' is almost certainly a software library or tool integrated into the CI pipeline. Its purpose is to *automatically* enforce GDPR compliance checks – flagging code that violates regulations concerning PII usage. Options A, B, C and D describe different aspects of data governance but aren't the core function of a privacy compliance tool within a development workflow.
14 / 14
The product manager asks: 'We need to ensure our mobile app adheres to CCPA. Should we use differential privacy to add noise to the data before sending it to analytics services?' What is differential privacy? Differential privacy adds noise to data to obscure individual contributions while preserving overall trends
Differential privacy is a sophisticated technique specifically designed to protect individual privacy while still allowing for meaningful statistical analysis. It works by adding carefully calibrated 'noise' or randomness to the data – this ensures that no single individual's contribution can be identified, whilst preserving overall trends and patterns. Options A, B and D describe different security/data management approaches.
What does the "Privacy Engineering Tooling Vocabulary" exercise practise?
Learn privacy engineering tooling vocabulary: BigID PII scanning, data catalog with privacy classification, consent management platforms, privacy tests in CI, privacy design reviews — language for modern privacy engineering practice.
How many questions are in this exercise?
This exercise has 14 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Data Privacy category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Privacy Engineering Tooling Vocabulary" part of a larger series?
Yes — it's one exercise in the Data Privacy category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Data Privacy category page for related exercises, or browse the main Exercises hub for other IT English topics.