How do you implement a privacy-by-design approach in IT systems?

• A. Embed privacy controls into system architecture, data minimization, access controls, and transparent data handling
• B. Add privacy controls after deployment
• C. Ignore privacy and collect all data
• D. Limit privacy controls to marketing emails

Answer: (A)

Privacy-by-design means building privacy into every aspect of an IT system from the outset. This approach integrates privacy into the system’s architecture and how data is collected, stored, accessed, and disclosed. By designing for data minimization, you collect only what’s necessary, implement strict access controls so only authorized individuals can reach data, and keep handling practices transparent so users and auditors understand how data is used. This proactive, default-to-privacy mindset reduces risk and builds trust.

Adding privacy controls after deployment is reactive and often too late to address fundamental risks. Ignoring privacy and collecting all data directly contradicts the principle of minimizing exposure. Limiting privacy controls to marketing emails misses the broader data flows and system functionalities where privacy protections are still essential.