What is privacy by design in system development?

• A. Ignoring privacy until regulatory review.
• B. Focusing only on security features.
• C. Integrating privacy protections into the design and operation of IT systems from the outset.
• D. Adding privacy features after deployment.

Answer: (C)

Privacy by design means building privacy protections into every part of a system from the very start. It involves asking and answering questions about data from the ground up: what data is collected, why it’s needed, how long it’s kept, who can access it, and how it’s protected throughout the entire lifecycle—from requirements and architecture to development, deployment, and ongoing operation.

Key ideas include data minimization (collecting only what’s necessary), implementing strong defaults that prioritize privacy, using protections like encryption and strict access controls, and providing clear ways for users to exercise their data rights. It also means designing governance that supports transparency and ongoing accountability.

Why this approach is best is that it reduces privacy risks and compliance headaches before they arise, and it avoids costly rework that often accompanies adding privacy protections after a system is built or after regulatory review. Approaches that wait until later or focus only on security features miss that privacy is broader than safeguarding data; it’s about how data is collected, used, and governed across the whole system.