Privacy Engineer
Privacy Engineers translate legal and regulatory privacy requirements (GDPR, CCPA, PIPEDA) into technical implementations. Their daily work includes building consent management platforms, implementing data subject request pipelines, running privacy threat models on new features, and writing privacy impact assessments. This path builds the precise vocabulary needed to discuss privacy engineering decisions with legal teams, product managers, and regulators.
Topics covered
- Privacy by design
- Consent management
- Data subject rights
- PII & anonymization
- Privacy threat modeling
- Compliance engineering
Vocabulary spotlight
4 terms every Privacy Engineer should know in English:
Data Subject Access Request — a legally enforceable request from an individual to access, correct, or delete personal data held about them
"We built an automated DSAR pipeline that can fulfill right-to-erasure requests across all data stores within 30 days."
Replacing directly identifying information (e.g., name, email) with a non-identifying reference (e.g., a UUID), so the data can no longer be attributed to a person without additional information kept separately
"We pseudonymized user IDs in the analytics pipeline, storing the mapping table in a separate access-controlled system."
The GDPR principle that personal data should only be collected and retained to the extent necessary for its stated purpose
"The privacy review flagged that we were collecting birth dates for age verification but retaining them indefinitely — a data minimization violation."
Data Protection Impact Assessment — a structured process to identify and mitigate privacy risks before deploying a new system or processing activity involving personal data
"GDPR requires a DPIA for any high-risk processing — we ran one before launching the behavioural analytics feature."
📚 Vocabulary Reference
Key terms organised by category for Privacy Engineers:
Legal Frameworks
Data Subject Rights
Privacy Engineering
Assessments
Recommended exercises
Real-world scenarios you'll practise
- Writing a DPIA for a new analytics feature: documenting data flows, risk levels, and mitigation measures for regulatory review
- Presenting a privacy threat model to the product team: walking through LINDDUN threats identified on a new data processing feature
- Drafting an internal privacy policy: explaining data retention periods, lawful bases, and data subject rights in plain-English internal documentation
- Reviewing a vendor data processing agreement: identifying and negotiating clauses related to sub-processors and data transfer mechanisms