Privacy by Design (PbD) - Seven Foundational Principles

International

v2010 (GDPR-embedded 2018)

15 domains

20 controls

Privacy by Design (PbD) is a framework developed by Dr. Ann Cavoukian (former Ontario Information and Privacy Commissioner) establishing seven foundational principles for embedding privacy into the design of IT systems, business practices, and networked infrastructure. PbD is enshrined in GDPR Article 25 (Data Protection by Design and by Default), referenced in the California Privacy Rights Act, and adopted by data protection authorities worldwide. The seven principles guide organisations to proactively embed privacy throughout the entire data lifecycle rather than treating it as an afterthought. The International Assembly of Privacy Commissioners unanimously adopted PbD as an international standard in 2010.

Unverified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (15)

Corporate Transactions

1 controls

Controls in the Corporate Transactions domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-15	Privacy by Design in Mergers and Acquisitions	Apply Privacy by Design principles in mergers, acquisitions, and divestitures through due diligence, post deal integrati...

Emerging Technology

1 controls

Controls in the Emerging Technology domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-16	Algorithmic and AI Privacy Engineering	Apply Privacy by Design to algorithmic and AI systems through training data minimisation, model privacy assessment, expl...

Foundational Principles

3 controls

Seven PbD principles

Controls in the Foundational Principles domain of Privacy by Design (PbD) - Seven Foundational Principles — 3 controls
Code	Title	Description
PBD-FP-01	Proactive and Preventive	Principle 1: Proactive not reactive - preventive not remedial. Anticipate and prevent privacy events. Principle 2: Priva...
PBD-FP-02	Embedded and Full Lifecycle	Principle 3: Privacy embedded into design - integral component not bolt-on. Principle 4: Full functionality - positive-s...
PBD-FP-03	Transparency and User-Centric	Principle 5: End-to-end security - full lifecycle protection from cradle to grave. Principle 6: Visibility and transpare...

Governance

1 controls

Controls in the Governance domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-14	Privacy Metrics and Reporting	Define and report privacy metrics including PIA coverage, rights request timeliness, breach metrics, training completion...

Implementation

5 controls

Controls in the Implementation domain of Privacy by Design (PbD) - Seven Foundational Principles — 5 controls
Code	Title	Description
PBD-10	Data Minimisation Operationalised	Implement data minimisation as a default with controls preventing collection beyond stated purposes, including form desi...
PBD-11	Consent Management Platform	Operate a consent management platform capturing granular, informed, and freely given consent with audit trail, withdrawa...
PBD-12	Privacy Architecture Patterns Library	Maintain a library of approved privacy architecture patterns including data tokenisation, attribute based access control...
PBD-8	Privacy Impact Assessment Methodology	Operationalise PbD through a Privacy Impact Assessment methodology covering scoping, data flow analysis, risk assessment...
PBD-9	Privacy Enhancing Technology Adoption	Adopt privacy enhancing technologies such as differential privacy, federated learning, secure multiparty computation, an...

Implementation

0 controls

Giving effect to provisions through national laws, collective agreements, or other appropriate means.

Controls in the Implementation domain of Privacy by Design (PbD) - Seven Foundational Principles — 5 controls
Code	Title	Description
PBD-10	Data Minimisation Operationalised	Implement data minimisation as a default with controls preventing collection beyond stated purposes, including form desi...
PBD-11	Consent Management Platform	Operate a consent management platform capturing granular, informed, and freely given consent with audit trail, withdrawa...
PBD-12	Privacy Architecture Patterns Library	Maintain a library of approved privacy architecture patterns including data tokenisation, attribute based access control...
PBD-8	Privacy Impact Assessment Methodology	Operationalise PbD through a Privacy Impact Assessment methodology covering scoping, data flow analysis, risk assessment...
PBD-9	Privacy Enhancing Technology Adoption	Adopt privacy enhancing technologies such as differential privacy, federated learning, secure multiparty computation, an...

People

1 controls

Controls in the People domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-13	Privacy Champions Network	Establish and resource a privacy champions network across business units to embed privacy thinking into local decisions,...

Principle 1 Proactive

1 controls

Controls in the Principle 1 Proactive domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-1	Proactive Not Reactive Approach	Anticipate and prevent privacy invasive events before they happen, rather than waiting for risks to materialise, through...

Principle 2 Default

1 controls

Controls in the Principle 2 Default domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-2	Privacy as the Default Setting	Ensure the maximum degree of privacy is automatically protected by default settings without requiring user action, inclu...

Principle 3 Embedded

1 controls

Controls in the Principle 3 Embedded domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-3	Privacy Embedded into Design	Embed privacy into the design and architecture of IT systems and business practices as a core component, not bolted on a...

Principle 4 Full Functionality

1 controls

Controls in the Principle 4 Full Functionality domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-4	Full Functionality Positive Sum	Accommodate all legitimate interests and objectives in a positive sum win win manner, avoiding false dichotomies such as...

Principle 5 End to End

1 controls

Controls in the Principle 5 End to End domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-5	End to End Security Lifecycle Protection	Provide end to end security and privacy protection across the entire lifecycle of personal data from collection through...

Principle 6 Visibility

1 controls

Controls in the Principle 6 Visibility domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-6	Visibility and Transparency	Maintain visibility and transparency to all stakeholders that practices and technologies operate according to stated pro...

Principle 7 User Centric

1 controls

Controls in the Principle 7 User Centric domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-7	Respect for User Privacy User Centric	Keep the interests of individuals uppermost by providing strong privacy defaults, appropriate notice, empowering user fr...

Standards

1 controls

Controls in the Standards domain of Privacy by Design (PbD) - Seven Foundational Principles — 1 controls
Code	Title	Description
PBD-17	ISO 31700 Conformance Assessment	Conduct conformance assessment against ISO 31700 1 for consumer goods and services applying Privacy by Design, including...

Frequently Asked Questions

What is Privacy by Design (PbD) - Seven Foundational Principles?

Privacy by Design (PbD) - Seven Foundational Principles is a compliance framework from International with 15 domains and 20 controls. Privacy by Design (PbD) is a framework developed by Dr. Ann Cavoukian (former Ontario Information and Privacy Commissioner) establishing seven foundational principles for embedding privacy into the design of IT systems, business practices, and networked infrastructure. PbD is enshrined in GDPR Article 25 (Data Protection by Design and by Default), referenced in the California Privacy Rights Act, and adopted by data protection authorities worldwide. The seven principles guide organisations to proactively embed privacy throughout the entire data lifecycle rather than treating it as an afterthought. The International Assembly of Privacy Commissioners unanimously adopted PbD as an international standard in 2010. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Privacy by Design (PbD) - Seven Foundational Principles have?

Privacy by Design (PbD) - Seven Foundational Principles has 20 controls organised across 15 domains. The largest domains are Implementation (5 controls), Foundational Principles (3 controls), Corporate Transactions (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Privacy by Design (PbD) - Seven Foundational Principles map to?

Privacy by Design (PbD) - Seven Foundational Principles does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with Privacy by Design (PbD) - Seven Foundational Principles compliance?

Start your Privacy by Design (PbD) - Seven Foundational Principles compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Privacy by Design (PbD) - Seven Foundational Principles requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 20 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required