# Data subject rights, tracking consent and encryption

*Marketing Cloud Engagement Administrator Study Guide · Digital Marketing Proficiency · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator/digital-marketing-proficiency/data-subject-rights-tracking-consent-and-encryption*

Which Marketing Cloud Engagement tool answers each data subject request (Contact Delete, Contact Restriction, a portability extract, DoNotTrack), how Data at Rest Encryption, Field-Level Encryption and Key Management protect stored data, which data must never be stored, and the admin-account best practices that keep an account recoverable.

- Certification: Salesforce Marketing Cloud Engagement Administrator
- Exam section: Digital Marketing Proficiency
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator

**Official exam objective:**

> Recognize security best practices for data, permissions, and PII.

## What the exam expects

- Map each data subject right (erasure, restriction of processing, portability, tracking consent) to the Marketing Cloud Engagement tool that fulfils it.
- Tell Email Studio's DoNotTrack attribute apart from MobilePush Do Not Track and from an unsubscribe.
- Choose between Data at Rest Encryption, Field-Level Encryption and Tokenized Sending for sensitive data, and name the data that must never be stored.
- Describe Key Management: its key types, the AMPscript symmetric functions' limits, and that it is on by default.
- Apply admin-user best practices for data and permission safety.
- Key terms: **Contact Delete** (removes contact information from Marketing Cloud Engagement); **Contact Restriction** (freezes a copy of contact data and blocks further activity); **DoNotTrack** (stops recording behavioral data for a subscriber); **Field-Level Encryption** (encrypts data extension fields at rest, decrypted at send time); **Key Management** (stores the keys used to encrypt, decrypt, sign and run SSO).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Erasure | Contact Delete in Contact Builder or the Contact Delete REST resources | [Data Protection and Privacy Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_data_protection_privacy.htm&type=5&language=en_US) |
| Restriction of processing | Contact Restriction REST API freezes a copy and blocks further activity | [Data Protection and Privacy Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_data_protection_privacy.htm&type=5&language=en_US) |
| Portability | Automation Studio data extract on the contact's key or ID | [Data Protection and Privacy Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_data_protection_privacy.htm&type=5&language=en_US) |
| DoNotTrack | Configure for the account, then set in Email Studio; stops recording behavior (an unsubscribe is separate) | [Data Protection and Privacy Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_data_protection_privacy.htm&type=5&language=en_US) |
| Field-Level Encryption | Contact Builder data extensions only; decrypted at send time; Professional Services required | [Field-Level Encryption](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_field_level_encryption.htm&type=5) |
| Key Management | On by default; Asymmetric, Symmetric, IV, Salt, SSH, SSO Metadata | [Key Management](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_key_management.htm&type=5&language=en_US) |
| AMPscript symmetric functions | Work only on data contained in Marketing Cloud Engagement | [Key Management](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_key_management.htm&type=5&language=en_US) |
| Never store | Government IDs, financial account numbers, PCI DSS identifiers | [Key Management](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_key_management.htm&type=5&language=en_US) |
| Admin redundancy | Multiple admins; at least one admin without SSO | [User Management Best Practices](https://help.salesforce.com/s/articleView?id=002192966&language=en_US&type=1) |

## Check yourself

- Why is Contact Restriction, not Contact Delete, the answer when records may be needed later?
- Why does DoNotTrack not replace an unsubscribe?
- Why can't a field-level-encrypted field be added to a data extension created in Email Studio?
- Which two Key Management types would an admin use for SFTP authentication and a passphrase-based AMPscript key?

## Sources

- [Marketing Cloud Engagement Data Protection and Privacy Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_data_protection_privacy.htm&type=5&language=en_US)
- [Security Settings and Tools for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US)
- [Key Management](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_key_management.htm&type=5&language=en_US)
- [Field-Level Encryption in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_field_level_encryption.htm&type=5)
- [Do Not Track Email Opens and Clicks](https://help.salesforce.com/s/articleView?id=mktg.mc_es_do_not_track_email_opens_and_clicks.htm&language=en_US&type=5)
- [User Management Best Practices for Marketing Cloud Engagement Accounts](https://help.salesforce.com/s/articleView?id=002192966&language=en_US&type=1)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Administrator pack (USD $19): https://www.certifyforce.com/practice-exams