What does privacy by design entail in governance?

• A. Adding privacy features after deployment
• B. Incorporating privacy considerations into systems and processes from the outset, not as an afterthought
• C. Outsourcing privacy decisions to vendors
• D. Eliminating data collection to avoid privacy concerns

Answer: (B)

Privacy by design means weaving privacy into every stage of how a system or process is planned, built, and operated—not adding it on after everything else is done. In governance terms, this involves setting privacy requirements from the start, conducting privacy impact assessments, and engineering protections into the design itself. Think data minimization, purpose limitation, strong access controls, encryption, and pseudonymization by default, along with clear accountability and ongoing oversight. This approach also aligns with regulatory expectations and supports transparency and user control, because protections are built into the lifecycle rather than imposed later.

Choosing to add privacy features after deployment is reactive and risks gaps; outsourcing privacy decisions to vendors undermines internal accountability and governance, which is essential for privacy to be effectively managed; and simply eliminating data collection ignores the reality that some data is necessary—privacy by design focuses on protecting and limiting the data you do collect, not just avoiding data altogether.