# Privacy by Design

> A design rule that privacy protection is part of a system's design from its first version, covering which personal data it collects, how long it keeps it, who can see it and what its defaults expose.

Record: `architecture:privacy-by-design`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: contextual
Scope: data, product, system
Canonical: https://banes-lab.com/ontology#architecture-privacy-by-design

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Secrets Management](https://banes-lab.com/records/architecture/secrets-management.md) and before [Compliance](https://banes-lab.com/records/architecture/compliance.md).

## Repair

- Refactored by: Minimize Data, Add Retention/Delete Controls
- Detected by: personal-data flow without policy
- Violated by: collecting or retaining unnecessary personal data
- Measured by: personal-data surface, retention compliance
- Enforced by: privacy review, [policy-as-code](https://banes-lab.com/records/architecture/policy-as-code.md)

## Requires

- [Data Minimization](https://banes-lab.com/records/lexicon/data-minimization.md)
- [Consent/Policy](https://banes-lab.com/records/lexicon/consent-policy.md)

## Reinforces

- [Compliance](https://banes-lab.com/records/architecture/compliance.md)
- [Security](https://banes-lab.com/records/lexicon/security.md)

## Enables

- [Privacy Compliance](https://banes-lab.com/records/lexicon/privacy-compliance.md)

## Conflicts with

- [Personal Data Oversharing](https://banes-lab.com/records/architecture/personal-data-oversharing.md)

## In tension with

- [Analytics/Personalization](https://banes-lab.com/records/lexicon/analytics-personalization.md)

## Tensions

- [Privacy by Design / Analytics/Personalization](https://banes-lab.com/records/tension/analytics-personalization-privacy-by-design.md)

## Severity

- [contextual](https://banes-lab.com/records/vocabulary/severity-contextual.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Enforced by

- [runtime/entrypoints/leak.entrypoint.ts](https://banes-lab.com/source/build/runtime/entrypoints/leak.entrypoint.ts.md)

## Linked from

- [Anti-patterns](https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Quality Attributes](https://banes-lab.com/ontology/lexicon/lexicon-category-quality-attributes.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)