What Is Privacy-by-Design?
Privacy-by-Design (PbD) is an approach to system engineering that embeds privacy into the design and architecture of IT systems, business practices, and networked infrastructure from the outset — not as an afterthought.
The concept was developed by Dr. Ann Cavoukian, former Information and Privacy Commissioner of Ontario, Canada, and has since been adopted as a legal requirement under both the EU GDPR (Article 25) and the UK GDPR.
The Legal Requirement
Under UK GDPR Article 25, data controllers must implement appropriate technical and organisational measures “both at the time of the determination of the means for processing and at the time of the processing itself.” This means privacy must be considered:
- Before you build a product or service
- During development and testing
- After launch, through ongoing monitoring
The ICO can and does enforce this. In its 2024 guidance, the ICO made clear that “privacy by design is not optional — it is a legal obligation.”
The Seven Foundational Principles
Dr. Cavoukian’s framework defines seven principles:
1. Proactive not Reactive; Preventative not Remedial
Anticipate and prevent privacy-invasive events before they happen. Do not wait for risks to materialise.
In practice: Conduct a Data Protection Impact Assessment (DPIA) before launching any new product, feature, or processing activity.
2. Privacy as the Default Setting
Personal data should be automatically protected in any given system. No action should be required by the individual to protect their privacy.
In practice: Ship with the most privacy-protective settings enabled by default. If you offer analytics, make it opt-in, not opt-out.
3. Privacy Embedded into Design
Privacy should be embedded into the design and architecture of systems, not bolted on as an add-on.
In practice: Design your data flows to minimise personal data collection. Use pseudonymisation and encryption at the architecture level, not the application level.
4. Full Functionality — Positive-Sum, not Zero-Sum
Privacy-by-Design rejects the idea that privacy must come at the expense of other objectives. It is possible to have both privacy and security, both privacy and functionality.
In practice: Do not present privacy as a trade-off. Find solutions that deliver the business objective while protecting personal data.
5. End-to-End Security — Full Lifecycle Protection
Data must be securely retained and then securely destroyed at the end of its lifecycle.
In practice: Define retention periods for every category of personal data. Implement automated deletion. Encrypt data at rest and in transit.
6. Visibility and Transparency
Keep processes open and transparent to individuals and regulators. Published methodologies and clear privacy notices build trust.
In practice: Write privacy notices in plain English. Publish your data processing inventory. Be clear about sub-processors.
7. Respect for User Privacy — Keep it User-Centric
Above all, respect the individual. Offer strong privacy defaults, appropriate notice, and user-friendly options.
In practice: Give users genuine control over their data. Make it easy to access, correct, and delete their information.
Why It Matters for UK Businesses
Beyond the legal requirement, Privacy-by-Design delivers tangible business benefits:
- Reduced compliance costs: Fixing privacy issues early is cheaper than retrofitting them later.
- Reduced breach risk: Systems designed with privacy in mind have smaller attack surfaces.
- Customer trust: In a market where data breaches are weekly news, demonstrable privacy practices are a competitive advantage.
- Regulatory confidence: The ICO looks favourably on organisations that can demonstrate PbD. It can be the difference between a warning and a fine.
- Future-proofing: The EU AI Act, the UK Online Safety Act, and emerging regulations all build on PbD principles.
Getting Started
If your organisation has not yet implemented Privacy-by-Design, start with these steps:
- Audit your current data flows. Map what personal data you collect, why, where it goes, and how long you keep it.
- Conduct DPIAs for any processing that is likely to result in high risk to individuals.
- Review your defaults. Are your products and services shipping with the most privacy-protective settings?
- Train your team. Developers, product managers, and designers all need to understand PbD principles.
- Get independent review. An external privacy-by-design review can identify blind spots your team may miss.
How We Can Help
At Cosmo Codex, we provide Privacy-by-Design Reviews that assess your product architecture, data flows, and controls against these principles. We also offer GDPR Compliance Audits for organisations that need a broader compliance assessment.