What does 'privacy by design' mean in vendor risk management?

• A. Adding privacy features only after product release.
• B. Outsourcing privacy decisions to vendors.
• C. Isolating privacy considerations from product development.
• D. Integrating privacy considerations into product development, vendor selection, and processing activities from the outset.

Answer: (D)

Privacy by design means embedding privacy into every stage of product development and vendor engagement from the start. In vendor risk management this approach requires considering privacy risks early when evaluating and selecting vendors, shaping contracts with data processing agreements that specify data handling, access, and breach responsibilities, and conducting privacy impact assessments as new processing activities or vendors are introduced. It also means building in privacy protections by default—data minimization, strong access controls, encryption, secure data retention, and clear data subject rights handling—across all suppliers and subprocessors, with ongoing monitoring as processing evolves. This proactive integration reduces risk and aligns with regulatory expectations, rather than waiting until after release, deferring privacy decisions to vendors, or isolating privacy from development.