What is the difference between privacy and data ethics in a governance programme?

Privacy as the baseline governance control

Privacy is the rule set that constrains how personal information is collected, used, shared, retained, and protected. In a governance programme, it usually defines the minimum lawful and policy-compliant position: purpose limitation, data minimisation, retention limits, access boundaries, and handling for sensitive categories. For identity data specifically, a privacy and consent guide for identity data is often where those practical obligations become operational.

That baseline matters because privacy work is usually tied to legal duties and demonstrable controls. The GDPR is a useful reference point for the kind of obligations privacy programmes often translate into governance requirements, especially when organisations must justify why data is collected, how long it is kept, and whether it is appropriate to process at all.

Data ethics asks the stronger question

Data ethics goes beyond compliance. It examines whether a data use is responsible, transparent, fair, accurate, proportionate, and consistent with the intent of the people affected. A privacy-compliant use can still be ethically weak if it is opaque, overly intrusive, manipulative, or likely to produce unfair outcomes. That is why ethics is often the second filter after privacy, not a substitute for it.

In practice, ethical review is most useful where the data may be lawful but still contentious: profiling, secondary use, automated decision support, inferred attributes, or broad reuse across teams. The NIST Privacy Framework is a strong external reference for connecting data governance to privacy risk management, while still leaving room for the broader judgement calls that ethics requires.

How governance programmes should separate the two

A mature governance programme treats privacy and data ethics as related but different decision layers. Privacy answers whether the organisation may collect or process the data under legal and policy constraints. Data ethics asks whether the use is justified, proportional, and trust-preserving even when it is technically allowed. That distinction is especially important when teams want a single approval path for every data initiative.

The most practical model is to route every material use through both lenses: first confirm the privacy basis, then test the ethical rationale. For assurance-heavy programmes, governance teams can align controls to NIST SP 800-53 Rev. 5 Security and Privacy Controls for control discipline, while using ethics review to challenge whether the intended use still makes sense once transparency, fairness, and proportionality are examined.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while GDPR defines the regulatory obligations.

Framework	Control / Reference	Relevance
GDPR	Art. 5 — Principles relating to processing of personal data	Defines baseline privacy governance principles for personal data use
	Art. 25 — Data protection by design and by default	Supports embedding privacy constraints into governance from the start
Recommendation — Map personal-data uses to lawful purpose, minimisation, and retention limits. Build privacy requirements into approval and design workflows upfront.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Supports limiting who can access personal data in governance programmes
	AU-2 — Event Logging	Supports accountability and traceability for privacy-controlled data use
	DM-01 — Data Inventory and Flow Mapping	Helps governance teams know what personal data exists and where it moves
Recommendation — Restrict access to personal data to the minimum required roles. Log data access and material processing actions for review and audit. Inventory personal data flows before approving new uses.

Practitioner Guidance

What to prioritise: Separate the approval criteria. If a use case passes privacy review but still feels high-risk, force an ethics review rather than stretching the privacy decision to cover both.

What to verify: Confirm that the programme records the legal basis, purpose, retention, and access conditions for privacy, and separately documents the rationale, fairness considerations, and expected user impact for ethics.

Common mistake: Treating “we can do this lawfully” as equivalent to “we should do this.” That shortcut usually appears when data reuse expands faster than governance.

Practitioner takeaway: Privacy sets the permission boundary, but data ethics is the judgment layer that protects legitimacy, trust, and long-term governance quality.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.