IELTS vocabulary: Cybersecurity and Data Privacy

Cybersecurity and data privacy show up as a Task 2 subtopic under technology or, increasingly, as its own prompt about whether individuals or companies bear more responsibility for protecting personal information online. The vague-vocabulary failure mode here is treating every incident as "getting hacked" and every safeguard as "having strong passwords," which flattens a topic that actually has quite distinct categories — an attack is not the same as a breach, and privacy is not the same as security, even though the two get used as if they were synonyms. This article separates threats, protective measures, privacy specifically, and the regulatory response, since a well-developed essay usually needs to move between at least two of these categories rather than staying in one.

On threats, start with distinguishing the attack from its outcome. A "cyberattack" is a deliberate attempt to compromise a system, network, or device, while a "data breach" is one possible outcome of that attempt — protected information being accessed or exposed without authorisation — but a breach can also occur without any attack at all, through employee error, a misconfigured server, or a lost device. "Phishing" is a social-engineering technique that tricks a person into revealing credentials or clicking a malicious link, usually via a message disguised as legitimate, and is worth distinguishing from "malware" (malicious software designed to damage, disrupt, or gain unauthorised access to a system), since phishing is often the delivery method for malware rather than the same thing as it. "Ransomware" is a specific, increasingly newsworthy type of malware that encrypts a victim's files and demands payment for their release, and "identity theft" refers to someone using another person's stolen personal information to commit fraud, typically as a downstream consequence of a breach rather than the breach itself.

Protection vocabulary lets an essay move past "use strong passwords" into genuinely differentiated mechanisms. "Data encryption" converts information into a coded form unreadable without the correct key, protecting it both in storage and in transit. "Two-factor authentication" requires two separate, independent forms of verification (typically a password plus a one-time code sent to a device) before granting access, meaningfully reducing the risk of unauthorised account access even when a password alone has been compromised. "Firewall" describes a system that monitors and controls network traffic according to security rules, acting as a barrier between a trusted internal network and an untrusted external one. "Cybersecurity measures" functions as a useful umbrella phrase for gesturing at this whole category without listing every mechanism individually in a single sentence, which keeps a paragraph controlled rather than turning into a list.

Privacy vocabulary is a genuinely separate thread from security, even though the two constantly appear together. "Data privacy" concerns who can access personal information and for what purpose, which is a different question from "security," which concerns protecting systems and data from unauthorised access regardless of who is "supposed" to see it in the first place — a company can have excellent security (nobody can break in) while still having poor privacy practices (it uses your data in ways you never agreed to). "Informed consent" describes a user knowingly and willingly agreeing to specific data uses, and "data collection practices" is the broader phrase for what information a company gathers and how. "Data minimisation" is the practice of collecting only the data genuinely necessary for a stated purpose, an upstream principle distinct from "anonymisation," which is a downstream fix — stripping identifying detail from data that has already been collected. "Digital footprint" (the trail of data a person leaves through online activity) and "third-party data sharing" (a company passing collected data to another organisation, often for advertising) round out the vocabulary needed to discuss privacy as its own distinct concern rather than folding it back into "cybersecurity" generally.