Further Reading: Privacy Engineering

Sources are tagged Tier 1 (confident it exists, recommended without reservation) or Tier 2 (real and worth seeking, but confirm the current edition, version, or URL yourself).

Two warnings before the list. First, this material dates faster than anything else in this book — statutes are amended, adequacy decisions are struck down, and guidance is reissued. Prefer the regulator's current text over any book's summary of it. Second, this is the one chapter where the primary sources are genuinely readable. GDPR is about 55,000 words and its operative articles are plainer than most engineering documentation; the ICO's guidance is written for practitioners. You do not need an intermediary for this material as much as you think.

Read the actual regulations

GDPR, Articles 5, 6, 12–22, 25, 32, and 33–34. That is the engineering subset: principles, lawful bases, data-subject rights, privacy by design, security, and breach notification. Article 5 is one page and is the whole philosophy; Article 17 is erasure; Article 25 is §31.11's argument in legislative form. Free, official, and searchable. Tier 1.
The ICO's guidance (UK) — the best practitioner-facing writing on this subject anywhere, and it is free. The pages on anonymisation, on retention, and on the right to erasure are directly relevant to §31.4, §31.5, and §30.7. Their position on backups is the one §31.5 paraphrases, and reading the original is worth twenty minutes. Tier 1.
CCPA/CPRA, and the California Privacy Protection Agency's regulations. Different structure, same six capabilities. Read it after GDPR and notice which differences are substantive (the sale/share opt-out, the 45-day clock) and which are vocabulary. Tier 1.
The EDPB's opinions and guidelines, particularly anything on anonymisation and pseudonymisation. Dense, and the definitive statement of where the line sits in the EU. Tier 2 — find the current version; earlier Article 29 Working Party opinions are superseded but still widely cited.

On anonymization, which is the technical heart of the chapter

Latanya Sweeney, "k-Anonymity: A Model for Protecting Privacy" (2002), and her earlier work showing that 87% of the US population is uniquely identified by ZIP, date of birth, and sex. §31.4 exists because of this result, and the paper is readable. If you read one paper from this chapter, read this one. Tier 1.
Machanavajjhala et al., "l-Diversity: Privacy Beyond k-Anonymity" (2006). The homogeneity attack — a k-anonymous class where everyone shares the sensitive value. Short, and it is the first thing anyone asks after you present k-anonymity. Tier 1.
Narayanan and Shmatikov, "Robust De-anonymization of Large Sparse Datasets" (2008) — the Netflix Prize re-identification. The paper that should be read by anyone about to release an "anonymized" dataset, and the empirical version of Case Study 2's composition finding. Tier 1.
Cynthia Dwork and Aaron Roth, The Algorithmic Foundations of Differential Privacy (2014). The standard reference, free as a PDF, and mathematical. Read the first two chapters for the definition and the intuition; the rest is for when you are implementing. Tier 1.
The US Census Bureau's material on their 2020 disclosure-avoidance system. The largest real deployment of differential privacy, and unusually candid about the utility cost — which is §31.4's claim, argued in public by people with a great deal at stake. Tier 2 — a large body of documents; start with the overview papers.
Damien Desfontaines' blog (desfontain.es), the "differential privacy" series. The clearest informal explanation available, written by someone who implements it. Better than most textbook treatments for building intuition. Tier 2 — a personal site; confirm the URL.

On deletion, and the architecture that makes it possible

The Apache Iceberg and Delta Lake documentation on row-level deletes, deletion vectors, and DELETE FROM. §31.5's answer to undeletable Parquet, and Case Study 1's migration. Read the deletion-vector design docs, not just the SQL syntax — the mechanics explain why the cost collapsed. Tier 1 — versioned.
Anything on crypto-shredding / cryptographic erasure. NIST SP 800-88 (Guidelines for Media Sanitization) covers the concept formally; cloud vendors' envelope-encryption documentation covers the mechanics. The per-subject key management is the hard part and the part nobody writes about well. Tier 2.
Your warehouse's documentation on time travel, fail-safe, and backup retention. Snowflake's Time Travel and Fail-safe pages, BigQuery's time-travel window, RDS automated backups. You cannot write §31.5's coverage report without knowing these numbers, and most engineers do not. Tier 1.

On detection and classification

Microsoft Presidio — open-source PII detection and anonymization, and a substantially more capable version of pii_scan.py. Read its recognizer registry to see how a serious implementation handles the precision problem that §31.2 measures. Tier 1.
Google Cloud DLP / Sensitive Data Protection, and AWS Macie — the managed equivalents. Worth reading the documentation even if you do not buy them, because the infoType taxonomies are a good checklist of what to look for. Tier 1.
Anything on the base-rate problem in screening. §31.2's false-positive argument is an instance of a general result, and one clear treatment of screening-test arithmetic will make the 225-false-positive calculation feel inevitable rather than surprising. Tier 2 — statistics and epidemiology texts do this better than security ones.

On masking and access

Snowflake's masking policy and row access policy documentation; the BigQuery column-level security and data-masking pages; Databricks Unity Catalog's equivalents. Read the section on how policies interact with views and with COPY/unload, which is where the leaks are. Tier 1 — versioned.
Chapter 30 Case Study 2 of this book. The access review that could not say no. §31.6's policies are the enforcement half of that story.

On the parts that are not technical

Your own legal or privacy counsel. Said in §31.6 and worth repeating: an hour with the person who owns the policy is worth more than any book on this list, and it is skipped remarkably often. Bring §31.5's coverage report and §31.2's scan output; arriving with facts changes the conversation completely.
Woodrow Hartzog, Privacy's Blueprint (Harvard, 2018). On design as a privacy decision, from the legal side. Argues the position §31.11 assumes — that privacy is a property of what you build, not a review you pass. Tier 1.
The IAPP's practitioner material and the CIPT certification syllabus. The syllabus itself is a useful map of what a privacy technologist is expected to know, even if you never sit the exam. Tier 2.

Practice

code/pii_scan.py in this chapter. Detection scored three ways, a k-anonymity ladder, and a deletion-coverage report, with eighty self-checks. --k-anon is the one to run first; the shape of the output is the chapter's central argument.
Measure k on something you actually ship. Exercise 31.6. If your organization sends any extract to anyone, this is a genuinely valuable hour and it is very unlikely anyone has done it.
Write the manifest. Exercise 31.8. Fifteen entries minimum, including logs and vendors. The discomfort you feel around entry nine is the point of the exercise.
Ask the question that started Case Study 1. "If a customer asks us to delete everything, how long does that take?" It is the cheapest question in this chapter and almost nobody has asked it.

A note on what to be skeptical of

Any product that claims to make you compliant. Compliance is a property of an organization's practices, not of a purchase, and the six capabilities in §31.1 are ones your platform either has or does not.

Any use of "anonymized" without a number. Case Study 2's whole finding. The word is a claim about a measurement, and if nobody ran the measurement it is a claim about a feeling.

Any privacy assessment that produces a document and no assertion. §31.11: a control that is an assertion cannot go stale, and one that is a document can — which is Chapter 30's by-product argument, in the one domain where the cost of staleness is legal.