Privacy by Design: Audit and Assessment
How auditors assess whether privacy by design principles are genuinely embedded into systems development and data processing.
Privacy by design is a foundational concept embedded in modern privacy regulations, most notably the GDPR's Article 25, which requires organizations to build data protection considerations into systems and processes from the outset rather than treating privacy as an afterthought. For CISA candidates, understanding the core principles of privacy by design and how auditors assess whether it has been genuinely implemented is increasingly important given the growing overlap between IT audit and privacy compliance.
The Core Principles
Privacy by design, as originally articulated by Ann Cavoukian and later codified into regulation, rests on several foundational principles: being proactive rather than reactive in anticipating privacy risks, making privacy the default setting so users do not need to take action to protect their data, embedding privacy into the design of systems rather than bolting it on afterward, maintaining full functionality without unnecessary trade-offs between privacy and business objectives, ensuring end-to-end security across the entire data lifecycle, maintaining visibility and transparency to all stakeholders, and respecting user privacy by keeping interfaces user-centric.
Data Protection Impact Assessments (DPIAs)
The primary mechanism through which privacy by design is operationalized is the data protection impact assessment (DPIA), a structured process for identifying and mitigating privacy risks before a new system, process, or data processing activity is launched. Auditors assessing an organization's privacy program should verify that DPIAs are triggered appropriately (typically for high-risk processing activities such as large-scale profiling, processing of special category data, or new technologies), that DPIAs are completed before the processing activity begins rather than retroactively, that identified risks are genuinely mitigated (or, where residual risk remains high, escalated to the relevant data protection authority as required), and that DPIA findings actually influence system design decisions rather than being a compliance formality completed after the design is finalized.
Auditing Technical Implementation
- Data minimization: verifying that systems collect only the data actually necessary for the stated purpose, not the maximum data technically obtainable
- Purpose limitation: confirming that data collected for one purpose is not silently repurposed for another without a valid legal basis
- Pseudonymization and anonymization: assessing whether techniques such as tokenization or data masking are applied where appropriate to reduce identifiability
- Default privacy settings: testing that new accounts or features default to the most privacy-protective configuration, requiring explicit user action to reduce protection rather than the reverse
- Retention enforcement: confirming automated data deletion or archival mechanisms actually execute according to documented retention schedules
Integrating Privacy into the SDLC
A mature privacy by design program embeds privacy checkpoints directly into the software development lifecycle, similar to how security is embedded through DevSecOps practices. This typically includes a privacy risk screening question set early in project intake, mandatory DPIA completion for qualifying projects before development begins, privacy-focused code review or design review checkpoints, and privacy testing (such as verifying data flows match documented data maps) prior to production release.
Common Audit Findings
Frequent findings in privacy by design audits include DPIAs completed as documentation exercises after a system is already built (undermining the entire purpose of proactive risk identification), inconsistent application of data minimization across different product teams, default settings that favor data collection over privacy, and a lack of clear accountability for translating DPIA findings into actual engineering backlogs and tracked remediation.
Exam Relevance
CISA candidates should understand privacy by design as both a regulatory requirement under frameworks like GDPR and a practical control framework that auditors assess through DPIA process testing, technical control verification, and SDLC integration review, rather than through policy review alone.