Which practice aligns with privacy by design?

• A. Integrating privacy considerations into product development and vendor selection from the outset.
• B. Adding privacy features after product release.
• C. Outsourcing privacy decisions to vendors.
• D. Isolating privacy considerations from development.

Answer: (A)

Privacy by design means weaving privacy into every stage of how a product is built and how vendors are chosen, from the very start. It involves considering data flows, purposes, minimization, access controls, retention, and user rights during design reviews, and aligning procurement with privacy requirements so vendors meet those expectations. By embedding these protections from the outset, privacy features become the default, not an afterthought, and accountability is built into the development process.

This is why integrating privacy into product development and vendor selection from the outset is the best approach. It reduces risk of noncompliance and data breaches, supports stronger security, and builds user trust by ensuring privacy controls are integral to the design rather than retrofitted later.

Options that add privacy features after release are reactive and can be costly or insufficient to address data flows and risk. Outsourcing privacy decisions to vendors can dilute accountability and leave gaps in governance. Isolating privacy considerations from development creates silos and weakens the protection of data throughout the lifecycle.