Practice privacy by design vocabulary: privacy as default, embedding privacy in architecture, privacy threat models, data subject rights, and privacy impact assessments.
0 / 10 completed
1 / 10
'Privacy as _____' means the most privacy-protective settings are active by default without user action.
'Privacy as default' is one of the 7 foundational principles of Privacy by Design — the strictest privacy settings apply automatically, without user configuration.
2 / 10
'The design review includes a privacy _____ model.' What type of review is this?
A privacy threat model identifies privacy risks in the architecture early in design, similar to security threat modeling (e.g., STRIDE).
3 / 10
What does DSR stand for in privacy engineering?
DSR stands for Data Subject Request — a formal request by a user to exercise their GDPR rights (access, erasure, portability, rectification).
4 / 10
What does PIA stand for?
PIA stands for Privacy Impact Assessment — a systematic process to evaluate privacy risks of a new feature or system before it is built.
5 / 10
'Embedding privacy in architecture' means:
Embedding privacy in architecture means privacy controls are designed into the system structure (data flows, storage, APIs) rather than bolted on after launch.
6 / 10
Sarah (Senior Developer) just submitted a pull request to update the user profile API. During the code review, she mentioned implementing 'privacy by design' principles. Which of the following best describes what she's aiming for in this context?
Privacy by design isn't about technical security measures alone; it's a proactive approach where privacy considerations are built into the system's architecture and functionality from the beginning. Option B accurately reflects this – focusing on reducing what data is collected and giving users control over their information, which aligns with core principles of privacy by design. Options A, C, and D represent security best practices but don't capture the fundamental philosophy of proactively embedding privacy.
7 / 10
Mark (Product Manager) is writing a PR description for a new feature that collects user location data. He wants to clearly communicate the team's approach to privacy. Which statement would be MOST appropriate to include?
Option B is the most relevant because it directly addresses privacy by design – specifically highlighting data minimization (not collecting unnecessary location data) and transparency (clearly informing users about how their location is being tracked). The other options focus on technical details or business outcomes, neglecting the foundational principle of proactively incorporating privacy considerations into the feature's development. This demonstrates a thorough understanding of the concept.
8 / 10
David (Lead Engineer) is discussing the team's approach to new GDPR requirements with a junior developer. He uses the term 'data mapping'. What does he *primarily* mean?
Data mapping refers specifically to meticulously documenting how personal data moves through an organization's systems – it's about understanding the entire lifecycle of that data. This is crucial for compliance with regulations like GDPR, which requires organizations to know where their data resides and who has access to it. Options A, C, and D represent related activities but don't capture the core meaning of data mapping.
9 / 10
Emily (Legal Counsel) is reviewing a proposed change to an application's consent management system. She asks the development team if they've considered implementing 'purpose limitation'. What does this mean in the context of their work?
Purpose limitation is a key principle of privacy by design and GDPR. It dictates that you should only collect and process personal data for the specific purpose(s) you've clearly communicated to users and obtained their consent for – or have a legitimate basis for. Option A relates to access controls, C to code management, and D to data retention policies. Understanding this distinction is vital for maintaining user trust and complying with privacy regulations.
10 / 10
During a standup meeting, Ben (Developer) says, 'We're applying the principle of 'privacy by design' to this new microservice. We've built in default restrictions on what data it can access and how it can be used.' What is Ben *most* likely referring to?
Ben is emphasizing proactive privacy controls – specifically using RBAC to restrict data access based on user roles and permissions. This aligns directly with privacy by design, which focuses on embedding these restrictions at the architectural level from the outset. While options A-D represent important security measures, they don't capture the core concept of designing for privacy by default.
What will I practice in "Privacy by Design Vocabulary"?
This is a Privacy Engineering exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of privacy engineering terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the privacy engineering vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Privacy Engineering exercises?
See the Privacy Engineering exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — privacy engineering vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.