Privacy by Design

The seven privacy by design principles, privacy goals and specifications, and evaluating privacy risk in user experiences through UX concepts, usability testing and value sensitive design.

5 minutes 5 Questions

Privacy by Design (PbD) is a foundational framework in the CIPT body of knowledge, developed by Dr. Ann Cavoukian, former Information and Privacy Commissioner of Ontario, in the 1990s. It holds that privacy should be built into the design and architecture of IT systems, business practices and netwo…

Concepts covered
The Seven Privacy by Design PrinciplesEnd-to-End Security, Visibility and Respect for User PrivacyUX Concepts for Privacy-Related FunctionsPrivacy Embedded into Design and Full FunctionalityHow UX Decisions Impact User Privacy BehaviorCommunicating Privacy by Design Goals in the OrganizationHigh-Level and Low-Level Privacy SpecificationsValue Sensitive DesignProactive Not Reactive and Privacy as the Default SettingUsability Testing of Privacy-Related FunctionsDefining Privacy Goals and Objectives
Test mode:
Start practice test

CIPT - Privacy by Design Example Questions

Test your knowledge of Privacy by Design

Question 1

Which of the following best describes the intent of the privacy by design principle commonly summarized as Full Functionality, Positive-Sum, not Zero-Sum?

Correct Answer: Accommodating all legitimate objectives so privacy and security are both achieved together

Ann Cavoukian's Privacy by Design principle of Full Functionality, Positive-Sum, not Zero-Sum holds that a system should accommodate all legitimate interests and objectives, so that privacy and security, or privacy and functionality, are achieved together rather than one at the expense of the other.
Balancing privacy against security describes exactly the zero-sum trade-off the principle rejects. Delivering features first and adding privacy controls after launch contradicts the proactive and embedded principles. Prioritizing privacy over functionality whenever they conflict is still a zero-sum approach, only in privacy's favor.
Key concept: Privacy by Design's positive-sum, win-win approach that rejects false trade-offs.

Question 2

A product team has redesigned the controls that let users restrict which contacts can see their activity. Before release, the privacy technologist runs a usability test. The goal is to learn whether participants actually achieve the sharing restrictions they intend, and not only whether the controls feel easy to use. Which test measure BEST shows how effective the redesigned privacy function is?

Correct Answer: Rate at which resulting configurations match each participant's stated sharing goal

Effectiveness in usability testing means users accurately complete their intended goal, so comparing each resulting configuration against the participant's stated sharing goal directly shows whether the privacy control works as intended.
Reaching the save confirmation screen only shows task completion, not whether the saved settings are correct. Post-task confidence measures satisfaction and perception, and users can be confident yet wrong, which is a common privacy risk. Task time and click counts measure efficiency, not accuracy of the outcome.
Key concept: the ISO 9241-11 usability dimensions of effectiveness, efficiency and satisfaction, where effectiveness is the accuracy and completeness of achieving the user's intended privacy outcome.

Question 3

A product team is preparing to launch a home security camera app with a community feed where users can post recorded clips. In the current build, clip sharing is enabled by default. Users can opt out through a settings menu, which is described in a detailed privacy notice. A privacy technologist reviews the build against the seven privacy by design principles. Which design change BEST addresses the gap?

Correct Answer: Ship with clip sharing switched off and let users opt in to each clip

Turning clip sharing off by default and requiring users to opt in for each clip applies Privacy as the Default Setting, so personal data stays protected unless the user acts.
Expanding the notice improves transparency, but users who never read it still have their clips shared automatically. Encryption protects clips in transit and at rest, yet the clips are still published without the user's active choice. Pseudonymizing uploader accounts reduces identifiability, but recorded home footage can still reveal identities and locations, and sharing remains on by default.
Key concept: Privacy as the Default Setting, one of the seven privacy by design principles.

More Privacy by Design questions
296 questions (total)
Practice 100 questions
One session at a time, always new questions