Privacy by design: principles and implementation

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

An example scenario: a company built a product with 100,000 users. During due diligence before a funding round, it discovered a huge privacy exposure in its data architecture, and it lost the round. Privacy by design is not just “the right thing to do”. It is a matter of business survival.

What is privacy by design?

Privacy by Design (PbD) is an approach to product development in which privacy protection is built into the system from day one, not added afterwards. The idea was developed in the 1990s by Dr. Ann Cavoukian of Canada. It became a legal duty in 2018, when the European GDPR came into force (Article 25).

In Israel, the Protection of Privacy Regulations (Data Security), 5777-2017 go in the same direction. They require organizations to adopt security measures suited to the sensitivity of the information and to the risks. In other words, to think of privacy as part of the design, not as a checkbox.

The seven principles of privacy by design

Cavoukian set out seven guiding principles. This is how they look in practice in a technology company:

1. Prevention, not correction: identify privacy risks before development, not with a check after the code is in production. Threat modeling at the design stage.
2. Privacy as the default: the product shares as little information as possible and requires active consent to share more. The default is “don’t share”, not “share everything”.
3. Privacy built into the architecture: privacy protection is part of the technical design, not an external plugin. Encryption, network separation and minimum access are planned in advance.
4. Not zero-sum: privacy and security do not conflict with functionality. You can build a product that does both. “It will hurt the user experience” is usually an excuse, not a real limitation.
5. End-to-end security: the data is protected from the moment it is collected until it is deleted. Not only in transit, but also in storage, in backups, and in every internal interface.
6. Transparency and openness: users know what is collected, why, and how. Not a 40-page privacy policy that nobody reads, but real transparency.
7. Respect for user privacy: sensitive information gets more protection, consents can be withdrawn, and users can access and delete their data.

Practical implementation in software development

Four tools that every development team should adopt:

• Data Flow Diagram: a map of the data’s whole journey: where it is collected, where it moves, who can reach it, and when it is deleted. Without a map, you cannot know where the exposure is.
• Data Minimization: collect only what you really need. A rich database is an asset, but also a liability. Every unnecessary field is a potential leak.
• Access Control: define exactly who accesses what and when, rather than giving every developer sweeping access to all the data. The principle of least privilege.
• Retention Policy: data that is no longer needed is deleted (see retention periods under the law). Old backups that pile up are one of the most common sources of leaks.

Privacy Impact Assessment: when and why

A DPIA (Data Protection Impact Assessment) is a process for assessing how a new project will affect privacy. Under the GDPR it is required before processing that is likely to result in a high risk. Examples are large-scale processing of special categories of data, such as biometric or medical data, or systematic and extensive profiling (Article 35). In Israel it is not required by law, but it has become an important legal protection tool.

A DPIA includes: a description of the data processing, an assessment of necessity and lawfulness, identification of the risks to data subjects, and mitigation measures. A company that carried out a DPIA and documented it is in a much better position before a regulator and before a court, if a breach occurs.

What happens to companies that don’t implement it?

Three main exposures:

• Regulatory fines: under the GDPR, a breach of Article 25 can lead to a fine of up to EUR 10 million or 2% of worldwide turnover (Article 83(4)). A breach of the processing principles, such as data minimization, can lead to a fine of up to EUR 20 million or 4% (Article 83(5)). In Israel, since Amendment No. 13, the Privacy Protection Authority may also impose a monetary sanction for a breach of the Data Security Regulations (section 23Z(h) and the Third Schedule to the Protection of Privacy Law). For example, anyone who did not carry out, or did not document, the yearly check of whether the information in the database is more than needed for its purposes (regulation 2(c)) is exposed to a monetary sanction. It is NIS 2,000 for a database at the basic security level, NIS 40,000 at the medium level and NIS 160,000 at the high level (item 3 of the Third Schedule). These are base amounts, updated on 1 January each year under section 23FF(b).
• Civil claims: people harmed by a privacy breach can sue for compensation. In large-scale breaches, a motion to certify a class action may also be filed.
• Business damage: data leaks have destroyed companies. Investors, business customers and international partners check privacy as a deal breaker. GDPR readiness has become an entry requirement for the European market.

A checklist for a company that wants to start

Five practical steps for a company that is starting to implement it:

1. Appoint a DPO (Data Protection Officer). Since Amendment No. 13 this is a duty for public bodies, for data brokers, and for those whose main activity includes systematic monitoring or processing sensitive information on a significant scale (section 17B1; see who must appoint an officer after Amendment No. 13). In all other cases, at least an internal person in charge. Someone has to own the subject.
2. Create a Data Inventory: a list of all the personal information you hold, where it came from, and where it is kept.
3. Carry out a DPIA for new projects: before the sprint, not after it.
4. Write a Privacy Policy that people can read: short, clear and accurate.
5. Train the development team. A developer who knows what PbD is will make better decisions without waiting for a lawyer.

Frequently asked questions

Is a privacy impact assessment (DPIA) mandatory in Israel?

In Israel it is not required by law, but it has become an important legal protection tool. Under the GDPR it is required before processing that is likely to result in a high risk. Examples are large-scale processing of special categories of data, such as biometric or medical data, or systematic and extensive profiling (Article 35).

We have a good privacy policy. Is that privacy by design?

No. The policy is a document; PbD is architecture. You can have an excellent policy alongside a completely broken architecture.

Who must appoint a privacy protection officer (DPO)?

Since Amendment No. 13 this is a duty for public bodies, for data brokers, and for those whose main activity includes systematic monitoring or processing sensitive information on a significant scale (section 17B1 of the Protection of Privacy Law). In all other cases, it is worth appointing at least an internal person in charge.