Compliance

Privacy-by-design

Incorporating data protection into systems' design and architecture.

How the laws define this

Every cited source agrees that privacy-by-design requires proactively embedding privacy considerations directly into the initial development stages, design, or architecture of systems to prevent privacy issues and harms from the outset rather than addressing them later. However, the instruments diverge on operational scope and specific technical requirements. IEEE 7002-2022 — Standard for Data Privacy Process uniquely extends the requirement beyond initial development to include the ongoing operation of information systems and practices. Meanwhile, Protection of Privacy Act (Bill 33) explicitly frames this concept as a mandatory principle applied across programs, systems, and services. Furthermore, while both Protection of Privacy Act (Bill 33) and IEEE 7002-2022 refer generally to privacy safeguards and considerations, the Datatilsynet Regulatory Sandbox for privacy-friendly innovation and AI (Sandbox for Responsible AI) specifically requires embedding defined data protection principles, explicitly identifying data minimisation, purpose limitation, and technical safeguards as essential components of system architecture.

Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Alberta, Canada	Protection of Privacy Act (Bill 33)	In Force	This definition narrows privacy-by-design to a foundational principle mandating safeguards specifically in public sector programs, systems, and services from initial development stages.
Norway	Datatilsynet Regulatory Sandbox for privacy-friendly innovation and AI (Sandbox for Responsible AI)	In Force	This definition widens the scope to embedding specific principles like data minimisation, purpose limitation, and technical safeguards into both systems and processes to prevent privacy harms.
IEEE	IEEE 7002-2022 — Standard for Data Privacy Process	In Force	This definition emphasizes proactive integration into the design and operation of information systems and practices, explicitly contrasting it as not an afterthought.

What it triggers

In Alberta, Canada, it mandates privacy programs, impact assessments, and strict rules for AI data use under the Protection of Privacy Act (Bill 33).
The Datatilsynet Regulatory Sandbox for privacy-friendly innovation and AI sets out guidance for developing privacy-compliant artificial intelligence tools.source
IEEE 7002-2022 sets out a standard for integrating data privacy processes into the systems engineering lifecycle using PIAs for compliance.

Definitions (3)

The practice of embedding data protection principles into the design and architecture of systems and processes—such as data minimisation, purpose limitation, and technical safeguards—to prevent or minimise privacy harms from the outset.

Datatilsynet Regulatory Sandbox for privacy-friendly innovation and AI (Sandbox for Responsible AI)Definition 1 of 3

A foundational principle mandating that privacy safeguards and considerations are embedded into the design and architecture of programs, systems, and services from their initial development stages.

Protection of Privacy Act (Bill 33)Definition 2 of 3

Privacy by Design is a core concept advocating for the proactive integration of privacy into the design and operation of information systems and practices. It ensures that privacy considerations are embedded from the initial stages of development, rather than being an afterthought, to prevent privacy issues.

IEEE 7002-2022 — Standard for Data Privacy ProcessDefinition 3 of 3

Not to be confused with

cybersecurity-by-design

Cybersecurity-by-design focuses on embedding security requirements at design and procurement, while this term targets privacy protections.

data protection

Data protection covers legal and technical measures to secure personal and sensitive data broadly, whereas this term specifically embeds those into system design from the start.

Data Privacy (AI Bill of Rights)

Data privacy emphasizes protection from abusive practices with user agency, unlike this term's focus on proactive design integration.

Questions and answers

What does privacy-by-design require in Alberta's public sector?

Alberta's Protection of Privacy Act (Bill 33) mandates embedding privacy safeguards into the design of programs, systems, and services from initial stages. It also requires privacy programs, impact assessments, and rules for AI data use.

How does Norway's sandbox approach privacy-by-design?

The Datatilsynet Regulatory Sandbox guides entities on embedding data protection principles like data minimisation into AI tools' design to minimise privacy harms.

What is covered in the IEEE standard for privacy-by-design?

IEEE 7002-2022 advocates proactive privacy integration into information systems from development start, using PIAs within the systems engineering lifecycle.