<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-privacy-by-design
description: >-
  Implement Privacy by Design (PbD) principles across software architecture
  and data processing systems per GDPR Article 25 using data minimization,
  purpose limitation, and privacy-enhancing technologies.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - privacy-by-design
  - gdpr
  - article-25
  - data-minimization
  - purpose-limitation
  - pbd
  - architecture
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Implementing Privacy by Design

## Overview

Privacy by Design (PbD) embeds privacy protections into system architecture from
inception rather than as an afterthought. Required under GDPR Article 25 ("data
protection by design and by default"), PbD mandates that controllers implement
appropriate technical and organizational measures — such as data minimization and
pseudonymization — at the time of determining processing means and during processing
itself.

Mode: `[MODE: ARCHITECT]` + `[MODE: PRIVACY]` — Architecture with privacy integration.

## Prerequisites

- Understanding of GDPR Article 25 and Cavoukian's 7 Foundational Principles
- System architecture documents or design specifications
- Data flow diagrams with processing purposes documented
- Python 3.10+ for assessment tooling

## Key Concepts

### Seven Foundational Principles

```text
1. Proactive not Reactive — prevent privacy harms before they occur
2. Privacy as the Default — maximum privacy without user action
3. Privacy Embedded into Design — integral part of architecture
4. Full Functionality — positive-sum, not zero-sum
5. End-to-End Security — full lifecycle protection
6. Visibility and Transparency — verifiable privacy claims
7. Respect for User Privacy — user-centric design
```

### GDPR Article 25 Requirements

```text
Art. 25(1) — Data Protection by Design:
  "appropriate technical and organisational measures, such as pseudonymisation,
   designed to implement data-protection principles, such as data minimisation"

Art. 25(2) — Data Protection by Default:
  "only personal data which are necessary for each specific purpose are processed"
  Applied to: amount collected, extent of processing, storage period, accessibility
```

### Privacy Engineering Patterns

| Pattern | Description | Principle |
|---------|-------------|-----------|
| Minimize | Collect only data required for stated purpose | Data minimization |
| Separate | Process data in isolated contexts per purpose | Purpose limitation |
| Abstract | Aggregate and generalize data at earliest stage | Data minimization |
| Hide | Encrypt, hash, or remove data from direct view | Confidentiality |
| Inform | Provide clear transparency about processing | Transparency |
| Control | Give data subjects meaningful control options | User autonomy |
| Enforce | Technical enforcement of privacy policies | Accountability |
| Demonstrate | Audit trails proving compliance | Accountability |

### Assessment CLI

```bash
# Assess a system design against PbD principles
node scripts/agent.js --action assess \
  --system "User analytics pipeline" \
  --data-categories "browsing,location,purchases" \
  --output /tmp/pbd_assessment.json

# Generate PbD checklist for a new project
node scripts/agent.js --action checklist \
  --phase "design" --output /tmp/pbd_checklist.json

# Evaluate data minimization for a schema
node scripts/agent.js --action minimize \
  --fields "name,email,dob,ssn,phone,address,purchase_history,ip_address" \
  --purpose "order_fulfillment" --output /tmp/minimization.json
```

## Workflow

### Step 1: Map Data Processing Purposes

Document every processing purpose and the data categories required for each.

### Step 2: Assess Privacy by Design Compliance

```bash
node scripts/agent.js --action assess \
  --system "Customer recommendation engine" \
  --data-categories "browsing,purchases,demographics"
```

### Step 3: Apply Data Minimization

```bash
node scripts/agent.js --action minimize \
  --fields "name,email,dob,ssn,phone,address,browsing_history" \
  --purpose "email_marketing"
```

### Step 4: Generate Implementation Checklist

```bash
node scripts/agent.js --action checklist --phase "development"
```

### Step 5: Review and Document

Document PbD measures taken and residual privacy risks for accountability (Art. 5(2)).

## Verification

- [ ] All processing purposes documented with legal basis
- [ ] Data minimization assessed — no unnecessary data collection
- [ ] Privacy defaults configured (opt-in, not opt-out)
- [ ] Pseudonymization or encryption applied where feasible
- [ ] Data retention periods defined per purpose
- [ ] User control mechanisms implemented (consent, access, deletion)
- [ ] Architecture diagram shows privacy controls at each data flow stage
- [ ] PbD assessment documented for accountability

## References

- [GDPR Article 25 — Data Protection by Design and Default](https://gdpr-info.eu/art-25-gdpr/)
- [Cavoukian — Privacy by Design: 7 Foundational Principles](https://www.ipc.on.ca/wp-content/uploads/resources/7foundationalprinciples.pdf)
- [EDPB Guidelines 4/2019 on Art. 25](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-42019-article-25_en)
- [ENISA Privacy by Design in Big Data](https://www.enisa.europa.eu/publications/big-data-protection)
- [NIST Privacy Framework](https://www.nist.gov/privacy-framework)
