Most companies treat privacy and security as two different jobs. Security belongs to the IT team: firewalls, passwords, updates. Privacy belongs to the lawyers: the policy page, the cookie banner, the GDPR paperwork. The two teams sit on different floors and rarely talk.
For the person whose data it is, that split makes no sense. You don’t care which department failed. You care that your data ended up somewhere it should not be. This article explains why privacy and security are really one promise, shows what happens when a company keeps only half of it, and ends with a few questions you can ask before you trust an app or a software vendor with your data.
Two questions about the same data
The simplest way to see the difference is to ask two questions.
Security asks: can someone who should not see the data get to it? Hackers, a thief with a stolen laptop, a former employee whose account still works.
Privacy asks: what do the people who are allowed to see it do with it? That means the company itself, its partners, and every service it plugs into.
Think of a flat you rent. Security is the lock on the door. Privacy is the landlord who has a key. A strong lock does not help if the landlord walks in every week and reads your mail. A polite landlord does not help if the door does not lock. You need both, or you have neither.
Security without privacy: the well-guarded data sale
Avast is a well-known antivirus company. Its products were sold to protect people online, including from tracking. According to the US Federal Trade Commission, from 2014 to 2020 Avast collected its users’ web browsing data through its software and browser extensions and sold it, through a subsidiary called Jumpshot, to more than 100 other companies. The FTC said the data was detailed enough to identify people again. In 2024 Avast agreed to pay $16.5 million and was banned from selling browsing data for advertising.
Nobody had to break in. The data was probably well protected from outside attackers. It just went out of the front door, on purpose, to buyers.
This is what security without privacy looks like. Strong walls around a warehouse of data that the owner uses however it wants. From the user’s side, the result is the same as a breach: your browsing history is in the hands of people you never chose.
Privacy without security: good intentions, open door
The opposite failure is just as common. A company writes a careful privacy policy, collects only what it needs, never sells anything. Then it gets hacked.
In 2022 attackers broke into the password manager LastPass and copied a backup of customer vaults. The passwords themselves were encrypted with each user’s master password. But according to the UK Information Commissioner’s Office, the stolen data also included unencrypted fields, such as website addresses, plus names, email addresses and billing addresses. In 2025 the ICO fined LastPass UK £1.2 million for failing to protect the data properly.
Website addresses sound harmless. They are not. A list of the sites you have logins for shows your bank, your doctor’s portal, your dating app, your employer’s internal tools. We wrote about why this kind of data matters in metadata is data. Some users also kept crypto wallet recovery phrases in their vaults, and researchers later linked millions of dollars in thefts to vaults cracked after the breach.
Whatever the company’s privacy intentions, the promise broke at the security layer. A privacy policy is only as strong as the systems that keep it.
The law already treats them as one
European regulators do not accept the split either. The GDPR has an article on security of processing (Article 32) and an article on data protection by design and by default (Article 25). Its core principles list “integrity and confidentiality” right next to data minimisation. Security is written into privacy law.
A recent Finnish case shows how far this goes. The online shop of the pharmacy company Yliopiston Apteekki used tracking tools that sent data about customers’ medicine purchases to Google and Meta, among others: when someone added a product to the basket and clicked buy, together with their IP address and other identifying data. There was no hack. The shop sent the data out itself.
The Finnish data protection authority fined the company in 2025 and found that it had broken the GDPR’s security rules, because it had not kept its customers’ personal data secure. Sending health-related shopping data to advertising platforms counted as a security failure, not only a privacy one. The authority said it was investigating similar problems at several other online pharmacies.
For any business that builds or buys software, this is the practical lesson. “We were not hacked” is not a defence. If your app leaks data to a third party through a tracking tool, the regulator can treat that exactly like an open door.
Why getting one right helps the other
The good news is that the two goals support each other.
- Less data means less to protect. Data you never collect cannot be stolen or sold. This is the strongest security measure there is, and we explained why in data that is never collected cannot leak.
- Fewer third parties means fewer doors. Every analytics or ad tool inside an app is another company with access to user data, and another place where a leak can start.
- Encryption that even the provider cannot open protects you from both sides. If the company cannot read your data, it cannot sell it, and a thief who steals its servers gets nothing useful.
- Data kept on your device stays under your control. No central database to hack, nothing for a landlord to read.
None of these is exotic. They are design choices made early, when they are cheap, instead of fixes bolted on after a fine.
What to ask before you trust an app or a vendor
You don’t need to be technical to check whether someone keeps both halves of the promise. Ask these questions, and notice whether the answers are clear or vague.
- What data do you collect, and why do you need each piece? A good answer is short. A long, fuzzy one is a warning.
- Who else gets it? Ask about analytics, advertising and “partners” by name. “Trusted partners” is not an answer.
- Can you read my data yourselves? If yes, ask who inside the company can and when.
- Where is it stored, and for how long? Data with no deletion date stays a risk forever.
- What happens if you are breached? Ask what an attacker would actually get, and how fast you would be told.
- Can I take my data out and delete it? If leaving is hard, the data is not really yours.
If a company can answer all six in plain words, it has probably thought about privacy and security as one thing. If it can only answer the security questions, or only the privacy ones, you now know which half is missing.
When we build apps, we start from the first question and work down the list. Our apps keep data on the device and carry no tracking or ad tools, so most of these questions get a one-line answer. That is the point. Whoever holds your data makes you one promise about it, and the lock and the landlord are both part of it.