Privacy by Design.

An engineering and governance approach that embeds privacy considerations into systems, processes, and defaults from the earliest design stages rather than bolting them on later. It belongs to the Privacy & Data Protection category of cybersecurity.

An engineering and governance approach that embeds privacy considerations into systems, processes, and defaults from the earliest design stages rather than bolting them on later.

Privacy by Design (PbD), articulated by Ann Cavoukian and codified in GDPR Article 25 as "data protection by design and by default," is built on principles such as proactive prevention, privacy as the default setting, end-to-end protection, full lifecycle visibility, and respect for user rights. In practice, teams perform threat modeling for personal data, integrate Data Protection Impact Assessments, apply minimization, pseudonymization, encryption, and least privilege, and document choices in records of processing. PbD complements security-by-design and aligns with NIST Privacy Framework, ISO/IEC 27701, and OECD guidelines, helping organizations avoid costly retrofits and reduce regulatory and reputational risk.

Defences for Privacy by Design typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Data Protection by Design, Privacy by Default.