Framework
Privacy by Design Framework
This framework operationalizes the data protection by design and by default obligation in GDPR Article 25 (Regulation (EU) 2016/679). It does so by mapping the seven foundational principles of privacy by design to the organization's architecture and development-security workflows, so that data-protection measures are built into systems at the design stage rather than retrofitted.
- Type
- Framework
- Version
- 1.0.4
- Date
- 2026-08-04
- Owner
- Data Protection Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Privacy
- Review frequency
- Annual and upon material regulatory, jurisdictional, or product change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Legal basis: GDPR Article 25
- The seven foundational principles
- Mapping the principles to architecture workflows
- Mapping the principles to development-security workflows
- Data protection by default (Article 25(2))
- Supporting instruments
- Operating expectations
- Metrics
- Framework alignment
- Limitations
Frameworks it maps to
- GDPR
- UK GDPR
- EDPB Guidelines 4/2019 (v2.0)
- Privacy by Design (Cavoukian)
- ISO/IEC 27701:2025
- ISO/IEC 29134:2023
- NIST IR 8062
Related documents
- Privacy and Data Governance Policyprivacy
- DPIA (Data Protection Impact Assessment) Templateprivacy
- Legitimate Interest Assessment (LIA) Templateprivacy
- Pseudonymization and Anonymization Standardprivacy
- Privacy Management Programme Charterprivacy
- Architecture Review Procedurearchitecture
- Secure Development and Engineering Policydev-security
- Data Classification and Handling Standardsecurity
Next
All Documents