Proving that privacy by design holds in Kite Money's shipped Split bill-sharing feature, layer by layer up the privacy control stack — requirements, minimisation, purpose, erasure, anonymisation, consent, third-party flows and continuous challenge — with the erasure layer lit: one user's erasure request was marked complete while the subject remained in 14 of 15 stores, and the re-trace now finds none, with a canary record reaching zero in all 15; and what left the app — silently uploaded contact lists and device identifiers sent to a fourth party — answered with an evidence pack for the regulator's inquiry.

CY-EXPERT-033Expert Level · Privacy Engineering

Privacy-by-Design Control Challenge — The Privacy Control Stack

An expert-level course that turns the sentence 'privacy by design applied' into controls that can fail, then challenges them in the real product. Work the privacy control stack - eight layers a requirement passes on its way to evidence: Privacy Requirements as Testable Controls; Data Minimisation & Collection Challenge; Purpose Binding & Use Limitation in Code; Retention, Deletion & Right-to-Erasure Proof; Pseudonymisation, Anonymisation & Re-identification Testing; Consent, Preference & Transparency Enforcement; Third-Party Flows, SDKs & Telemetry Leakage; and Continuous Challenge, Evidence & DPIA Linkage - as Noor, privacy engineering lead at Kite Money, answering a regulator's inquiry into a feature that uploaded contact lists, an SDK that leaked device identifiers to a fourth party and a deletion that left fourteen copies. Strictly defensive: every test runs in Kite Money's own environment against its own product, and every chapter's lab builds one component of the Split Control Challenge Report.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Rewrite DPIA claims as privacy controls with acceptance tests, owners and evidence sources, mapped to LINDDUN and control catalogues, under an authorised challenge plan.
Challenge collection and purpose in the real product: schema, event, permission and log audits, purpose tags, policy-as-code and ML training gates.
Prove erasure and anonymisation with evidence: erasure maps, tombstones, canaries, vendor certificates, k and l measurement, intruder tests and release decisions.
Enforce and verify consent and third-party flows: drift counts, opt-out tests, notice and UI audits, SDK inventories, egress captures and store declarations.

Price:৳12,000