Practise vocabulary for privacy-by-design: data minimisation, purpose limitation, privacy impact, privacy reviews, and proactive privacy measures.
0 / 10 completed
1 / 10
Privacy ___ means collecting only the personal data that is strictly necessary for the specified purpose — not 'just in case'.
Data minimisation (GDPR Article 5) requires collecting only data that is adequate, relevant, and limited to what is necessary. Collecting extra fields 'for future use' violates this principle and increases privacy risk.
2 / 10
A ___ Impact Assessment (DPIA) identifies and mitigates privacy risks before launching a new product feature or data processing activity.
A DPIA (GDPR Article 35) is mandatory for high-risk processing activities (large-scale profiling, biometric data). It systematically identifies privacy risks and documents how they're mitigated before processing begins.
3 / 10
'Privacy by design' means privacy protections are ___ into the system from the start, rather than added as an afterthought.
Privacy by design (Ann Cavoukian's 7 foundational principles) requires integrating privacy into system architecture during design, not bolted on afterwards. This means making privacy-protective choices in data flows, storage, access controls, and retention from day one.
4 / 10
The privacy principle of ___ means users should be able to access, correct, and delete their data without technical barriers.
Rights-by-design (user control) ensures the technical infrastructure supports data subject rights from launch: APIs for data access, deletion workflows, consent management, and preference centres — not retrofitted after complaints.
5 / 10
A privacy ___ is a meeting where engineers review a system design for privacy risks before implementation begins.
A privacy review (or privacy threat model) applies privacy principles to a proposed design, identifying risks: unnecessary data collection, missing access controls, insecure data transfers, and insufficient retention limits. Similar to a security design review.
6 / 10
Alex: 'I'm adding this new user profile field to collect birthday for marketing segmentation. It'll be great for targeted campaigns!'
As a senior developer, you need to address Alex's statement using the Privacy by Design principle. Which response best reflects this?
Alex's statement demonstrates a lack of understanding of Privacy by Design. The principle dictates that personal data collection should only occur when demonstrably necessary for the specified purpose. Simply stating it's 'great for marketing' doesn't justify gathering sensitive information like birthdays without careful consideration and consent mechanisms. Option 3 correctly identifies this gap.
7 / 10
You are reviewing a PR that includes logging user IP addresses to a server for analytics. The developer argues this is necessary to understand user behavior and improve the application's performance. Which statement best aligns with the Privacy by Design approach?
While analytics can be valuable, logging raw IP addresses presents substantial privacy concerns. The Privacy by Design principle emphasizes minimizing data collection; simply stating it's 'necessary for understanding user behavior' doesn't mitigate the risk of tracking users and potentially identifying them. Anonymization alone isn't sufficient if the underlying data is inherently identifiable.
8 / 10
During a Slack discussion about designing a new mobile app, Maria suggests: 'Let's just store all user data in one central database – it will be much easier to manage!' What is the primary concern regarding Maria's suggestion from a Privacy by Design perspective?
The Privacy by Design principle advocates for minimizing risk. Centralizing all user data into a single location creates a massive attack surface and significantly amplifies the impact of a security breach. This contrasts with distributing data to reduce the potential damage from a compromise. Maria's suggestion disregards this crucial element.
9 / 10
You're drafting a PR description for a new feature that allows users to download their data. The description should explicitly address the Privacy by Design principle of 'data minimization'. Which statement is MOST appropriate?
Data minimization is central to Privacy by Design. The PR description needs to clearly articulate *what* data is being downloaded and *why*. Simply stating 'easy download' doesn't address the principle of collecting only necessary information. Transparency about the scope of data transfer is key.
10 / 10
David, a junior developer, asks: 'Does it matter if we encrypt user passwords? We're using a standard hashing algorithm.' What response best incorporates the Privacy by Design principle of 'security by default'?
Security by Default is a core tenet of Privacy by Design. Relying solely on standard hashing algorithms isn't sufficient; strong encryption (like AES) should be implemented as the default security measure for passwords. This proactively protects user data and reduces the risk of compromise, even if users choose weak passwords.
What will I practice in "Privacy by Design Language"?
This is a Privacy Engineering exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of privacy engineering terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the privacy engineering vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Privacy Engineering exercises?
See the Privacy Engineering exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — privacy engineering vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.