Privacy-by-design principles: Getting it right from the start

To efficiently cater to their customers, businesses routinely collect various forms of personal data. Fifty years ago, when companies kept such data in filing cabinets, questions around privacy weren’t complex. However, in today’s Digital Age where personal data can be sent across thousands of miles in a matter of seconds, privacy is a much more pertinent issue than before.

Privacy-by-design is a concept that was first popularized in the 1990s by Ontario’s then information and privacy commissioner, Ann Cavoukian. By 2012, the U.S. Federal Trade Commission started to refer to it as a best practice for privacy. It’s now a key pillar of the EU’s landmark General Data Protection Regulation (GDPR).

Privacy-by-design simply means embedding privacy principles in the building and design of a business, website, application, product, or tool. Whichever way you look at it, ensuring that any capture and use of customer data is done with mutual consent is a good thing for the business in the long-term. Every organization should, therefore, strive to apply privacy-by-design principles.

Ann Cavoukian posited that privacy-by-design must be underpinned by the following seven principles.

1. Proactive and preventive versus reactive and remedial

Privacy-by-design principles are inherently proactive and preventative. It means anticipating privacy challenges beforehand. It implies creating the procedural and technical framework needed to prevent violations before they can occur. Businesses must apply privacy-by-design with an appreciation of the value they can derive from adopting strong privacy practices consistently and early.

There must be unequivocal commitment to privacy from the very top of the organization. That sets the tone for the rest of the employees. This commitment should exceed the requirements set out in regulations such as the GDPR. The privacy framework should include a means of recognizing weak designs, anticipating poor practices, and correcting negative impacts.

2. Privacy by default

Privacy shouldn’t be an afterthought that organizations take into consideration once they have perfected everything else. Instead, privacy considerations must be in place by default and automatically. That way, even where a user doesn’t make any explicit decisions about the privacy of their data, the enterprise applies privacy-by-design principles unless the users themselves specify otherwise.

For this to happen, the reason for the collection, use, retention, disclosure, and destruction of personal data must be made clear from the outset. Businesses should only capture the personal data they need. Organizations must configure their systems to keep data collection at the minimum. Where they have to collect data, they have to make it, as much as possible, unidentifiable, unobservable, and unlinkable.

3. Embedded privacy

Enterprises must integrate privacy into the design and development of technology systems, business procedures, and organization practices. That ensures privacy is a core component of the product’s, process’, or system’s functionality. They must embed privacy in a way that considers the broader context, ropes in all key stakeholders, and re-engineers all existing choices to ensure privacy compliance.

A principle approach to privacy that leverages frameworks and standards and is subject to external audits and reviews ought to be adopted. Conduct detailed assessments that detail the privacy risks and document the measures taken to contain the risks. The privacy strength of the technology, procedures, and policies shouldn’t be easily degraded through error, misconfiguration, or use.

4. Full functionality

Implementing privacy-by-design principles shouldn’t be part of a trade-off. It’s possible to deliver the full spectrum of a product’s capabilities and still have a robust privacy policy in place. You don’t have to compromise on operational and security capabilities in order to satisfy privacy requirements. You must see privacy as something that relays positive benefit for the business as opposed to being an impediment to effective operations. Of course, some innovation and creativity will be needed in certain cases to ensure that all privacy interests and desired functions are simultaneously satisfied.

5. Lifecycle protection

With privacy embedded in the entire organization’s systems and processes before the first piece of personal data is collected, privacy protection must also be extended throughout the life of the data. Establishing strong privacy measures at the start is meaningless if the data will not be subjected to a similar degree of protection up to its retirement and destruction.

There should be no room for privacy gaps from start to finish. For consistency, organizations should assign responsibility for a data set’s protection to a specific individual or department.

6. Privacy practices are applied and seen to be applied

All stakeholders must rest in the knowledge that the organization is doing everything in accordance with the commitments it has made in its privacy policy documents. This should be open to external verification.

It doesn’t serve any organization’s interest to adhere to privacy-by-design principles but not demonstrate that it does so. Perceptions matter and so just complying with privacy standards alone isn’t enough. Regulators and users shouldn’t just trust that you are doing the right thing. Rather, they must have a means of verifying the same.

7. Keeping the user at the center

Businesses exist to make a profit. So, it’s easy for entrepreneurs and business managers to get too caught up in chasing the bottom line as to forget who should be at the center of a privacy policy — the user. Yet, by centering the needs of their users and customers, enterprises will, in fact, be playing to and bolstering their own long-term interests.

After all, the personal data in the business’ possession belongs to the product user. The user has by far the highest vested interest in the privacy of their information. Businesses will be more effective in curtailing data abuse and misuse if they give users the power to decide how their data is used.

Privacy-by-design principles are good for business

Whereas the average organization knows and understands the reasons and merits of privacy, many have been less than enthusiastic about implementing privacy-by-design. It’s largely a result of the perception that privacy requirements can be an impediment to creative freedom.

On the contrary, though, a failure to apply and enforce privacy-by-design principles exposes the business to a wide range of risks including data breaches, regulatory censure, lawsuits, and loss of reputation.

Featured image: Pixabay

Stephen M.W.

Stephen regularly writes about technology, business continuity, compliance and project management. He's worked with companies such as,, and Citibank.

Published by
Stephen M.W.

Recent Posts

Losing your edge? 7 free tools to keep you focused at work

Staying focused at work in an always-connected world is hard! Here’s how to use tech — and some free tools…

11 hours ago

What’s next in the evolution of biometrics and facial recognition technology?

Facial recognition technology has matured to the point of being reliable — for better or for worse. What does the…

15 hours ago

Locking down your Exchange server with cipher suites

Cipher suites are a set of algorithms you need to secure your environment, either by using SSL and TLS. Here’s…

18 hours ago

AI cyber risks: What to look out for when deploying AI technology

Artificial intelligence has greatly improved modern life. But businesses must recognize that AI cyber risks exist and take appropriate measures.

1 day ago

Review: Office 365 synchronizing and administration tool CiraSync

CiraSync offers an enterprise solution for syncing global address list contacts and calendars to smartphones and other mobile devices. Here’s…

2 days ago

HIPAA IT compliance: Privacy and security rules you must know

HIPAA is the mandatory health regulation that must be followed strictly. But if you’re an IT pro in the health-care…

2 days ago