How Is Privacy Different from Information Security?

Information security and privacy are closely related. However, they are not the same. Privacy is defined here as an individual’s right to control the use and disclosure of his or her own personal information. This means individuals have the opportunity to assess a situation and determine how their data is used. Information security, in contrast, is the process used to keep data private.

Just because information is secure does not mean it is private. Likewise, just because information was collected in a privacy-protective way does not mean it is secure. Privacy with respect to information systems means that people have control over and can make choices about how their information is collected, used, stored, and shared. Information security concepts and controls are used to carry out those choices. Privacy cannot exist in information systems without security.

We are still learning about how privacy and information security concepts work together as our technology and regulatory environment becomes more complex. Today information security and privacy practitioners need to have a fundamental understanding of both topics to be effective.