Differential Privacy

Overview

Meaning and scope

Differential Privacy is a mathematical privacy model that limits how much the inclusion or exclusion of one individual’s data can change the output of an analysis. It is a formal property rather than a general synonym for anonymization, encryption, or data minimization.

Mechanism and operation

The control exists to protect personal and sensitive data while enabling lawful access, analysis, security, and business use under defined rights and governance. Decisions should consider individual rights, security needs, contractual duties, and the risk of revealing another person’s data. In this context, implementation requires a defined privacy unit, neighboring-dataset model, mechanism, privacy parameters, composition accounting, query controls, secure contribution bounds, utility evaluation, governance of privacy budgets, and clear communication of assumptions and residual risk. It should connect the term to Data Loss Prevention (DLP) where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Practical payment example

An analytics team publishes payment-size statistics with privacy-preserving noise. It documents the privacy budget and utility trade-off rather than claiming the aggregate is perfectly accurate for every subgroup.

Operational checks

Records should preserve data inventories, classifications, requests, identity checks, searches, disclosures, redactions, approvals, access events, incidents, exceptions, retention actions, and the rationale for decisions. Useful measures include sensitive-data coverage, unauthorized disclosures, request completion time, overdue requests, false-positive alerts, excessive access, retention exceptions, incident impact, and verified deletion or remediation.

Distinctions and limits

The workflow identifies data, purpose, legal basis, owner, location, recipients, retention, access, and risk before applying minimization, protection, monitoring, response, and deletion controls. The relationship with Auditability should be documented where it affects residual risk or control ownership. Implementation of Differential Privacy should map a mathematical privacy model that limits how much the inclusion or exclusion of one individual’s data can change the output of an analysis to the applicable entity, product, customer, transaction, and jurisdictional scope.

Related reading

Related definitions: Data Subject Access Request (DSAR), Data Loss Prevention (DLP).