Privacy by design
Privacy as the default, built into the design instead of bolted on, with data minimised and its handling visible. In practice it lives in everyday decisions about what is collected, where it is copied, who can read it, what is logged, and how deletion works across systems.
Evidence grade: practice A widely adopted practitioner model with clear provenance.
Use it when
Any system handling personal data; the design review; the access review.
Where it stops working
It is a set of principles and offers no procedure. A deletion request that finds data in six places is what happens when the principles were not applied one decision at a time.
Where the standard uses it
- TJ-6Security, privacy, and compliance as engineering responsibilitiesOwned by engineering, not delegated to a function.
Sources
- Ann Cavoukian. Privacy by Design: The 7 Foundational Principles. Information and Privacy Commissioner of Ontario, 2009. In the bibliography
Used alongside it
- Compliance as a programme practice
- Risk-based triage practice
- Security of AI-generated code research
- Threat modelling practice
Cite this model
Chicago, BibTeX and licence →Engineering Management Academy. (2026). Privacy by design. In Engineering Management Academy Body of Knowledge (Version 3.1, TEC.privacy-by-design). https://www.engineeringmanagement.academy/body-of-knowledge/techniques/privacy-by-design