# Privacy design review checklist for engineers

Use this at the design review of any feature that touches personal data. It follows GDPR Article 25
(data protection by design and by default) and the domains of the IAPP CIPT Body of Knowledge, version
4.0.0. It is an engineering aid, not legal advice; your privacy team decides what the law requires.

## Purpose and data

- [ ] The purpose of the feature, in one sentence, agreed with the product owner
- [ ] Every personal data field listed, with why the purpose needs it
- [ ] Fields that are not needed removed before build (data minimization)
- [ ] Sensitive or special-category data flagged for the privacy team

## By default (Article 25(2))

- [ ] Only the data necessary for each purpose is processed by default
- [ ] Collection, extent of processing, retention period and accessibility each set to the minimum by default
- [ ] Personal data not made accessible to an indefinite number of people without the person's own action

## By design (Article 25(1))

- [ ] Measures chosen with the state of the art, cost, the nature, scope, context and purposes of processing,
      and the risks to people in mind
- [ ] Pseudonymization or anonymization considered, and the choice recorded
- [ ] If releasing data or statistics: de-identification method chosen (for example k-anonymity or
      differential privacy) and its limits understood
- [ ] Encryption in transit and at rest, and who holds the keys

## Threats

- [ ] A privacy threat model of the design (for example LINDDUN), not only a security one
- [ ] Tracking and surveillance techniques in the feature identified and justified
- [ ] Software security risks that would expose personal data reviewed with the security team

## User experience

- [ ] Notices and choices placed where the person makes the decision
- [ ] No dark patterns: consent flows do not push people into broader consent than they intend
- [ ] Rights requests (access, deletion, correction) can be fulfilled for this feature's data

## Evidence

- [ ] Design decisions recorded, with the privacy reasons
- [ ] Controls tested, not only described in policy