Privacy by design
Definition
The obligation to embed data protection principles and safeguards into systems and processes from the design stage, and to process by default only the data necessary for each purpose.
Privacy by design moves data protection from after-the-fact review to the moment decisions are made. GDPR Art. 25 requires controllers to implement appropriate technical and organisational measures, such as pseudonymization and minimization, both when determining the means of processing and during the processing itself, taking into account the state of the art, cost, context and risks. Privacy by default adds that, out of the box, only necessary data is processed and personal data is not made accessible to an indefinite number of people. The LGPD (Art. 46, §2) requires security measures to be observed from the conception of the product or service.
Practical measures include privacy requirements in project intake, threat modelling, least-privilege access, short default retention, privacy-protective default settings and early DPIAs. ISO 31700-1 offers requirements for consumer products.
For AI, privacy by design means deciding early what data the model really needs, whether pseudonymized or synthetic data would work, how prompts are logged and how individuals can exercise their rights.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 3: Accountability tools.
Also covered in: Responsible AI Practitioner (RAIP)
Primary sources
- GDPR Art. 25
- LGPD Art. 46, §2
- ISO 31700-1:2023
- EDPB Guidelines 4/2019 on Art. 25