DSP-08 Data Privacy by Design and Default
Design privacy into systems, products and business practices, and ship them with privacy settings enabled by default as applicable law requires.
4
artefacts
2
held by a system
1
at each review
easy
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Design records showing privacy requirements considered at design stage · Data governance / DLP tooling
- Evidence of default privacy settings in the shipped configuration · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Review of defaults after a product change · Data governance / DLP tooling
governing documentDocuments that govern the control
- The legal requirements the defaults were set against · Policy repository / GRC workspace
First move
Automate the pull from your Data governance / DLP tooling. DLP policy hits, retention job logs and disposal certificates from the tooling.
Common gaps auditors find
- Privacy settings available but defaulted to the least protective option
- Privacy considered only where a regulator is expected to look
- Defaults set at launch and never rechecked as the product changed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDSP-07 Data Protection by Design and Default · DSP-09 Data Protection Impact Assessment