Privacy by Design
An approach that embeds privacy protections into the design and architecture of systems and processes from the outset.
Full Definition
Privacy by Design (PbD) is a framework developed by Ann Cavoukian that advocates embedding privacy into the design of IT systems, business practices, and physical infrastructure from the start — rather than adding it as an afterthought. GDPR Article 25 makes Privacy by Design and Privacy by Default legally mandatory for data controllers. The seven foundational principles include: proactive rather than reactive measures, privacy as the default setting, full functionality (positive-sum), end-to-end security, visibility and transparency, respect for user privacy, and privacy embedded into design. Practically, this means privacy engineers participate in product development, PIAs are conducted early, and data minimisation is applied at the schema level.
How each law treats it
Data protection by design and by default. Controllers must implement appropriate technical and organisational measures and, by default, process only the personal data necessary for each specific purpose.
The Section 8 reasonable security safeguards obligation incorporates privacy-by-design principles — minimise data collected, build in access controls, log retention and disposal.
The first ISO standard for Privacy by Design in consumer goods and services. Operationalises the Cavoukian principles into auditable requirements.
In practice
- Minimise collection at the UI layer. A form field that doesn't exist is one you don't have to delete, store or secure.
- Default to the least-permissive setting. Opt-in rather than opt-out, closed rather than public, local rather than cloud.
- Carry the privacy requirement into the engineering backlog — treat it like security, with linked tickets per project.
Common pitfalls
- Bolting privacy onto the end of a project. Article 25 explicitly says 'at the time of the determination of the means for processing and at the time of the processing itself'.
- Treating privacy-by-design as a slogan. It needs a review gate — the DPIA is the usual instrument.
- Letting dark patterns through the UI review. Consent that is engineered to be refused is not freely given.
Frequently asked questions
What are the seven Cavoukian principles?+
Proactive not reactive; privacy as the default; privacy embedded into design; full functionality (positive-sum); end-to-end security; visibility and transparency; respect for user privacy. GDPR Article 25 operationalises them.
Is Privacy by Design mandatory?+
Yes under GDPR Article 25 for anyone subject to the GDPR. The DPDP Act implies it through Section 8 security safeguards. Many regulators have fined organisations specifically for Article 25 failures (CNIL, ICO, Hamburg DPA).
How does ISO 31700 fit in?+
ISO/IEC 31700-1:2023 is the first horizontal Privacy by Design standard. Certification is not mandatory but is a strong signal in enterprise sales and in regulator reviews.
Related terms
Data Minimisation
The principle that only personal data that is adequate, relevant, and limited to what is necessary should be collected and processed.
DPIA
Data Protection Impact Assessment — a systematic process to identify and minimise privacy risks in new processing activities.
Data Controller
An entity that determines the purposes and means of processing personal data.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes