Which statement best describes privacy by design?

• A. Embedding privacy considerations into the design of systems from the start
• B. Encrypting all data by default only at rest
• C. Outsourcing privacy decisions to third-party vendors
• D. Removing privacy controls to speed up development

Answer: (A)

Privacy by design means making privacy a fundamental part of how a system is built, from the very beginning. It involves considering what data is collected, why it’s needed, how it’s used, who can access it, and how long it’s kept, and then embedding safeguards by default throughout the entire lifecycle—from design and development to deployment and maintenance. This proactive approach reduces privacy risks, supports compliance, and helps users trust the product by ensuring strong protections are not an afterthought but built into the architecture, data flows, and default settings.

The other ideas fall short because privacy by design isn’t limited to a single safeguard like encryption at rest, nor does it rely on outsourcing privacy decisions or removing controls. It requires a holistic approach—data minimization, secure default settings, access controls, governance, and ongoing privacy assessments—applied early and maintained over time.