Privacy Engineering Skills

Privacy engineering is the point where a privacy requirement stops being a policy sentence and becomes something in a system. It sits between legal and engineering and is scarce precisely because it requires being credible in both rooms.

Data minimization is where it starts

Most privacy risk is created at collection. Data you never collected cannot leak, cannot be subpoenaed, cannot be misused by a future team with a different idea, and does not need deleting later.

The engineering version of this is unpopular and effective: challenge the field. Why is date of birth on this form when an age band would serve? Why is precise location stored when a city would do? Every field removed at design time removes an obligation that would otherwise persist for the life of the system.

Techniques, and their honest limits

Pseudonymization replaces identifiers with tokens. It reduces risk and it is reversible by design, so pseudonymized data remains personal data under GDPR. People misuse this term constantly and it is worth being precise about.

Anonymization is meant to be irreversible, and true anonymization is much harder than it looks. Re-identification from supposedly anonymous datasets is a well-documented research result, and combining a few quasi-identifiers is frequently enough.

Differential privacy adds calibrated noise and gives a mathematical guarantee, expressed through a privacy budget. It is genuinely strong and it costs accuracy, which is a trade someone has to accept explicitly.

Encryption protects data at rest and in transit and does nothing about a system that is authorized to see the data and should not be.

Knowing which of these solves which problem, and saying so plainly, is most of the technical interview.

Building for the rights

Access, deletion, portability and correction are the ones that break architectures. A deletion request is straightforward until you consider backups, logs, analytics warehouses, third-party processors and a model trained on the data.

Systems designed without these in mind produce a manual scramble on every request, and the volume only rises. Designing for them means knowing at build time where personal data will live and how it will be found, which is exactly the lineage question in a privacy frame.

Consent that means something

Consent has to be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as to give. That last clause is the one most implementations fail, and regulators have been consistent about it.

Technically it means recording what was consented to, when, and against which version of the notice, then honoring withdrawal everywhere the data travelled. Which again returns to lineage.

Privacy and AI

Training on personal data raises questions the field has not settled. Whether a model memorizes its training data. Whether deletion is even meaningful once data has shaped model weights. What a legitimate basis for training looks like.

Nobody has clean answers. Being able to describe the problem precisely, and say which parts are unresolved, is currently more valuable than pretending to a solution, and hiring managers in this area can tell the difference immediately.

Where to go next

• Browse the jobs that use these skills
• Follow a career roadmap into the role you want
• Hiring for this? Start from a job description template
• Free certification study games, 592 practice questions

More in this series

• 9 Essential Data Governance Skills for the AI Era
• 10 Internal Audit Skills for Modern Assurance Careers
• 12 Transferable GRC Skills You May Already Have
• Technical vs. Nontechnical GRC Skills: What Employers Actually Need
• AI Governance Skills Employers Actually Hire For
• GRC Analyst Skills: What the Job Actually Requires
• Compliance Analyst Skills
• Risk Assessment Skills
• Controls Testing Skills
• Policy Writing Skills
• Regulatory Change Management Skills
• Third-Party Risk Skills
• Model Risk Management Skills
• AI Impact Assessment Skills
• AI Auditing Skills
• AI Evaluation and Testing Skills for Governance Careers
• Data Lineage Skills
• Data Quality Skills
• AI Security Skills
• AI Incident Response Skills
• Governance Program Management Skills
• Stakeholder Communication Skills
• Executive Risk Reporting Skills
• Evidence Documentation Skills
• Control Mapping Skills
• Framework Crosswalking Skills
• Vendor Due Diligence Skills
• Responsible AI Skills
• GRC Tools and Automation Skills
• How to Build the 9 Data Governance Skills: A 12-Month Career Plan