Privacy by Design

Privacy by Design (PbD) is a foundational framework in the CIPT body of knowledge, developed by Dr. Ann Cavoukian, former Information and Privacy Commissioner of Ontario, in the 1990s. It holds that privacy should be built into the design and architecture of IT systems, business practices and networked infrastructure from the outset, rather than added after deployment. In 2010, the International Conference of Data Protection and Privacy Commissioners adopted PbD as an international standard. Its spirit is now codified in Article 25 of the GDPR as 'data protection by design and by default.' PbD rests on seven foundational principles. First, be proactive, not reactive, and preventative, not remedial: anticipate and prevent privacy-invasive events before they occur. Second, make privacy the default setting: personal data is automatically protected without any action by the individual, for example through data minimization and limited retention. Third, embed privacy into design: privacy becomes an essential part of core functionality, not an add-on. Fourth, deliver full functionality through a positive-sum, not zero-sum, approach: reject false trade-offs such as privacy versus security and achieve both. Fifth, provide end-to-end security and full lifecycle protection: secure data from collection through use, storage and destruction. Sixth, maintain visibility and transparency: keep operations open and verifiable to users and stakeholders. Seventh, respect user privacy: keep systems user-centric, with strong defaults, appropriate notice and empowering, user-friendly options. For a privacy technologist, applying PbD means integrating privacy requirements into the software development lifecycle. It also means conducting privacy impact assessments and threat modeling early. Practitioners apply techniques such as data minimization, pseudonymization, anonymization, encryption, access controls and other privacy-enhancing technologies. The work involves collaborating with engineers, designers and legal teams to turn abstract principles into concrete design requirements, then validating those requirements through testing and review. Ultimately, PbD shifts privacy from a compliance afterthought to a core quality attribute. This reduces risk, lowers remediation costs and builds lasting user trust. Privacy by Design (PbD) is a foundational framework in the CIPT body of knowledge, developed by Dr. Ann Cavoukian, former Information and Privacy Commissioner of Ontario, in the 1990s. It holds that privacy should be built into the design and architecture of IT systems, business practices and netwo…