dataprivacybydesign

Dataprivacybydesign refers to a practice and framework for embedding privacy protections into the design, development, and operation of information systems and business processes. It aims to ensure that privacy features are built in from the outset, rather than added after deployment, and that protections adapt as systems evolve and new data uses emerge.

Its conceptual roots lie in Privacy by Design, introduced by Canadian privacy expert Ann Cavoukian in the 1990s. The approach is often summarized by seven principles: proactive not reactive, privacy as the default, privacy embedded into design, full functionality with a positive-sum outcome, end-to-end security, visibility and transparency, and respect for user privacy throughout the lifecycle.

Implementation involves privacy requirements engineering within the system development lifecycle, data mapping and risk assessment, and the use of technical controls such as data minimization, encryption, pseudonymization, strict access controls, and defined data retention. It also emphasizes governance, training, vendor management, and ongoing monitoring through audits and impact assessments.

Regulatory frameworks such as the GDPR require data protection by design and by default (Article 25). The concept also appears in other jurisdictions and is applicable across cloud services, AI systems, mobile apps, and the Internet of Things. Critics note challenges in balancing privacy with innovation and the need for substantive privacy outcomes beyond mere compliance.