The Seven Privacy by Design Principles: A Complete CIPT Study Guide
Introduction
Privacy by Design (PbD) is one of the most important frameworks in the IAPP Certified Information Privacy Technologist (CIPT) Body of Knowledge. It was developed in the 1990s by Dr. Ann Cavoukian, then Information and Privacy Commissioner of Ontario, Canada. It is built around seven foundational principles that tell organizations how to embed privacy into technology, business practices and physical infrastructure from the very beginning, instead of adding it later.
Why It Is Important
1. Global recognition: In 2010 the International Assembly of Privacy Commissioners and Data Protection Authorities adopted a resolution recognizing PbD as an essential part of fundamental privacy protection.
2. Legal codification: Article 25 of the EU General Data Protection Regulation (GDPR) turns the concept into a legal duty called Data Protection by Design and by Default. The U.S. FTC has also endorsed PbD in its 2012 privacy report. Many other laws and regulators expect it as well.
3. Cost efficiency: Fixing privacy flaws after deployment costs far more than designing them out early. This mirrors the security idea of shifting left.
4. Trust and competitive advantage: Products that respect privacy build customer confidence and reduce the risk of breaches, fines and damage to reputation.
5. Core to the technologist's role: The CIPT exam focuses on how technologists put privacy into practice in systems. PbD is the overarching philosophy behind that work.
What It Is: The Seven Foundational Principles
1. Proactive not Reactive; Preventative not Remedial
PbD anticipates privacy-invasive events and prevents them before they happen. It does not wait for risks to appear or offer fixes after a breach.
Example: Conducting a Privacy Impact Assessment (PIA) or threat model during the requirements phase, rather than responding to a breach after launch.
2. Privacy as the Default Setting
Personal data is protected automatically in any IT system or business practice. If the individual does nothing, their privacy stays intact. No action is required from the user to protect it.
Example: Social media profiles set to private by default. Optional data fields left unchecked. Location sharing turned off until the user opts in.
Key ideas tied to this principle: purpose specification, collection limitation, data minimization, and limits on use, retention and disclosure.
3. Privacy Embedded into Design
Privacy is built into the design and architecture of IT systems and business practices. It is not bolted on as an add-on. It becomes an essential part of the core functionality without reducing that functionality.
Example: Building pseudonymization into the database schema itself, rather than adding a separate masking tool afterward.
4. Full Functionality: Positive-Sum, not Zero-Sum
PbD rejects false trade-offs such as privacy versus security or privacy versus usability. It aims to meet all legitimate interests and objectives in a win-win way.
Example: A video analytics system that detects safety incidents while automatically blurring faces. Both security and privacy goals are met.
5. End-to-End Security: Full Lifecycle Protection
Strong security measures protect data from collection through use and retention to secure destruction at the end of its life (cradle to grave).
Example: Encryption in transit and at rest, access controls, logging, and secure deletion or crypto-shredding when the retention period ends.
6. Visibility and Transparency: Keep it Open
All stakeholders should be able to see that the business practice or technology operates as promised, and to verify this independently. This principle supports accountability, openness and compliance.
Example: Clear privacy notices, published data practices, third-party audits and certifications, and a reachable complaint and redress process.
7. Respect for User Privacy: Keep it User-Centric
Architects and operators must put the individual's interests first. This means strong privacy defaults, appropriate notice, and user-friendly options.
Example: Easy-to-use privacy dashboards, meaningful consent, and simple ways to access, correct or delete one's data.
Related concepts: consent, accuracy, access and compliance.
How It Works in Practice
PbD is a philosophy, not a step-by-step method. Technologists make it real through:
- Privacy requirements engineering: turning legal and policy needs into functional and non-functional system requirements.
- Privacy Impact Assessments and DPIAs: finding and reducing risk early (Principle 1).
- Data minimization and default configurations: collecting only what is needed and shipping with protective settings (Principle 2).
- Privacy-enhancing technologies (PETs): such as encryption, tokenization, anonymization, differential privacy and secure multiparty computation (Principles 3 and 5).
- Privacy design strategies: Jaap-Henk Hoepman's eight strategies (Minimize, Hide, Separate, Aggregate, Inform, Control, Enforce, Demonstrate) and privacy design patterns.
- Threat modeling frameworks: such as LINDDUN, which spots privacy threats like linkability and identifiability.
- SDLC integration: privacy checkpoints in the requirements, design, development, testing, deployment and decommissioning phases, including Agile user stories and DevOps pipelines.
- Transparency mechanisms: layered notices, just-in-time notices, dashboards and audit trails (Principle 6).
- User controls: consent management platforms and tools for data subject rights (Principle 7).
Criticisms You Should Know
PbD is sometimes criticized as vague and hard to turn into engineering requirements. This gap is why frameworks like Hoepman's strategies, the NIST Privacy Framework and privacy engineering methods emerged. The CIPT exam may test whether you understand that PbD is high-level and needs operational tools to be implemented.
Exam Tips: Answering Questions on The Seven Privacy by Design Principles
Tip 1: Memorize the exact names and their order. Use a mnemonic such as P-D-E-F-E-V-R: Proactive, Default, Embedded, Full functionality, End-to-end, Visibility, Respect. The exam may quote a principle's title or paraphrase its meaning.
Tip 2: Map the scenario to the principle by looking for keywords.
- Anticipate, prevent, before, early, PIA at the start → Proactive
- No action required by the user, opt-in, settings out of the box, minimization → Privacy as the Default
- Architecture, integral, core component, not bolted on → Embedded into Design
- Trade-off, win-win, both goals achieved, no compromise → Positive-Sum
- Lifecycle, retention, destruction, encryption, cradle to grave → End-to-End Security
- Verification, audit, openness, notice, accountability → Visibility and Transparency
- Individual's interests, user-friendly, consent, empowerment → Respect for User Privacy
Tip 3: Tell Default apart from Embedded. Default is about what happens when the user does nothing. Embedded is about how the system is architected. If the question mentions user inaction or initial settings, choose Default.
Tip 4: Tell Proactive apart from End-to-End Security. Proactive is about timing and anticipation (prevent before harm). End-to-End is about protecting data across its whole lifecycle with security controls.
Tip 5: Watch for zero-sum traps. Any answer suggesting privacy must be sacrificed for functionality, or the reverse, goes against Principle 4. The best answer usually achieves both.
Tip 6: Connect PbD to GDPR Article 25. Know that Article 25 requires appropriate technical and organizational measures, such as pseudonymization, both at the time of determining the means of processing and at the time of processing itself. It also requires that, by default, only personal data necessary for each specific purpose is processed.
Tip 7: Choose the earliest-intervention answer. When asked when privacy should be considered, the best answer is almost always at the beginning: concept, requirements or design phase. It is never after deployment.
Tip 8: Know who created it. Questions may ask about the originator (Dr. Ann Cavoukian, Ontario Information and Privacy Commissioner) or the 2010 international resolution adopting it.
Tip 9: Use elimination. Discard options that describe reactive fixes, require user effort to gain privacy, or treat privacy as an add-on. These contradict the core PbD philosophy.
Tip 10: Read for the best answer, not just a correct one. Several principles may apply to a scenario. Pick the one the scenario emphasizes most directly. For example, automatic deletion after a retention period touches Default and End-to-End, but its lifecycle focus makes End-to-End Security the stronger choice.
Quick Practice Example
Question: A fitness app ships with location tracking disabled, and users must actively enable it. Which PbD principle does this best illustrate?
Answer: Privacy as the Default Setting. Privacy is protected without any action required by the user.
Summary
The seven PbD principles are: Proactive; Default; Embedded; Positive-Sum; End-to-End Security; Visibility and Transparency; and Respect for the User. Together they form the philosophical foundation of privacy engineering. For the CIPT exam, know each principle's name and meaning, recognize it in practical scenarios, understand how technologists put it into practice, and link it to legal requirements such as GDPR Article 25.
