ENISA Data Protection Engineering - From Theory to Practice
ENISA's primary report on the practical engineering of data protection (the umbrella PET / privacy-enhancing-technology document for the EU). 'Data Protection Engineering - From Theory to Practice' (January 2022) sets the connection from Data Protection by Design (GDPR Art.25) to engineering practice via the DPIA process, and surveys the main PETs and their applicability to data protection principles: anonymisation and pseudonymisation, differential privacy, homomorphic encryption, secure multiparty computation, trusted execution environments, private information retrieval, synthetic data, end-to-end encryption, proxy/onion routing, privacy-preserving storage, attribute-based credentials, zero-knowledge proofs, privacy policies/icons/sticky policies, privacy preference signals, privacy dashboards, consent management, and mechanisms for exercising data subject rights of access, erasure and rectification. Complementary ENISA PET works are referenced in the report (Pseudonymisation techniques 2019, Advanced Pseudonymisation 2021, Engineering Personal Data Sharing 2023, Engineering Personal Data Protection in EU Data Spaces 2023).
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
ENISA DPE - Access, Communication and Storage
| Code | Title |
|---|---|
| ENISA-DPE-5.1 | Communication channels (end-to-end encryption, proxy/onion routing) |
| ENISA-DPE-5.2 | Privacy-preserving storage |
| ENISA-DPE-5.3 | Privacy-enhancing access control and authorisation (ABC, ZKP) |
ENISA DPE - Anonymisation and Pseudonymisation
| Code | Title |
|---|---|
| ENISA-DPE-3.1 | Anonymisation |
| ENISA-DPE-3.2 | Pseudonymisation |
| ENISA-DPE-3.3 | Differential privacy |
| ENISA-DPE-3.4 | Selecting an anonymisation scheme |
ENISA DPE - Conclusions and Assurance
| Code | Title |
|---|---|
| ENISA-DPE-7.1 | Defining the most applicable technique |
| ENISA-DPE-7.2 | Establishing the state of the art |
| ENISA-DPE-7.3 | Demonstrate compliance and provide assurance |
ENISA DPE - Engineering Data Protection
| Code | Title |
|---|---|
| ENISA-DPE-2.1 | From DPbD to data protection engineering |
| ENISA-DPE-2.2 | Connection with the Data Protection Impact Assessment |
| ENISA-DPE-2.3 | Privacy-Enhancing Technologies (overview and taxonomy) |
ENISA DPE - Introduction and Data Protection by Design
| Code | Title |
|---|---|
| ENISA-DPE-1.1 | Data Protection by Design |
| ENISA-DPE-1.2 | Scope of data protection engineering |
ENISA DPE - Privacy-Preserving Computation
| Code | Title |
|---|---|
| ENISA-DPE-4.1 | Homomorphic encryption |
| ENISA-DPE-4.2 | Secure multiparty computation (MPC) |
| ENISA-DPE-4.3 | Trusted execution environments (TEEs) |
| ENISA-DPE-4.4 | Private information retrieval (PIR) |
| ENISA-DPE-4.5 | Synthetic data |
ENISA DPE - Transparency, Intervenability and User Control
| Code | Title |
|---|---|
| ENISA-DPE-6.1 | Privacy policies |
| ENISA-DPE-6.10 | Exercising the rights to erasure and rectification |
| ENISA-DPE-6.2 | Privacy icons |
| ENISA-DPE-6.3 | Sticky policies |
| ENISA-DPE-6.4 | Privacy preference signals |
| ENISA-DPE-6.5 | Privacy dashboards |
| ENISA-DPE-6.6 | Consent management (gathering and systems) |
| ENISA-DPE-6.9 | Exercising the right of access |
Maps to 2 other frameworks
Frequently Asked Questions
What is ENISA Data Protection Engineering - From Theory to Practice?
ENISA Data Protection Engineering - From Theory to Practice is a compliance framework from European Union (ENISA) with 7 domains and 28 controls. ENISA's primary report on the practical engineering of data protection (the umbrella PET / privacy-enhancing-technology document for the EU). 'Data Protection Engineering - From Theory to Practice' (January 2022) sets the connection from Data Protection by Design (GDPR Art.25) to engineering practice via the DPIA process, and surveys the main PETs and their applicability to data protection principles: anonymisation and pseudonymisation, differential privacy, homomorphic encryption, secure multiparty computation, trusted execution environments, private information retrieval, synthetic data, end-to-end encryption, proxy/onion routing, privacy-preserving storage, attribute-based credentials, zero-knowledge proofs, privacy policies/icons/sticky policies, privacy preference signals, privacy dashboards, consent management, and mechanisms for exercising data subject rights of access, erasure and rectification. Complementary ENISA PET works are referenced in the report (Pseudonymisation techniques 2019, Advanced Pseudonymisation 2021, Engineering Personal Data Sharing 2023, Engineering Personal Data Protection in EU Data Spaces 2023). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does ENISA Data Protection Engineering - From Theory to Practice have?
ENISA Data Protection Engineering - From Theory to Practice has 28 controls organised across 7 domains. The largest domains are ENISA DPE - Transparency, Intervenability and User Control (8 controls), ENISA DPE - Privacy-Preserving Computation (5 controls), ENISA DPE - Anonymisation and Pseudonymisation (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does ENISA Data Protection Engineering - From Theory to Practice map to?
ENISA Data Protection Engineering - From Theory to Practice maps to 2 other compliance frameworks. The top mapping partners are GDPR (57% coverage), NIST Cybersecurity Framework 2.0 (11% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I get started with ENISA Data Protection Engineering - From Theory to Practice compliance?
Start your ENISA Data Protection Engineering - From Theory to Practice compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ENISA Data Protection Engineering - From Theory to Practice requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.
Get Started Free →Free forever — no credit card required