Certified Information Security Manager (CISM)Information Security Risk ManagementMedium
A global technology company is planning to launch a new product that involves collecting and processing a large volume of customer personal data. The information security manager is tasked with ensuring compliance with various international data protection regulations. Which approach BEST integrates privacy considerations into the product development lifecycle from its earliest stages?
- AEstablishing a dedicated privacy incident response team to handle potential data breaches post-launch.
- BImplementing robust data encryption and access controls after the product's core features are developed.
- CAdopting a Privacy by Design (PbD) framework, integrating privacy principles throughout development.
- DConducting a comprehensive privacy impact assessment (PIA) once the product is ready for user acceptance testing.
Show answer & explanationAnswer & explanation
Correct answer: C. Adopting a Privacy by Design (PbD) framework, integrating privacy principles throughout development.
Privacy by Design (PbD) is a proactive approach that embeds privacy considerations directly into the design and operation of IT systems and business practices from the outset. This ensures privacy is a core component, not an afterthought, and is critical for compliance with regulations like GDPR.
Why the other options are wrong
- A. An incident response team is for managing breaches, not for proactive integration of privacy into product development.
- B. This is a reactive approach, applying controls late in the process rather than integrating privacy from the start.
- D. Conducting a PIA at user acceptance testing is too late; privacy issues should be identified and addressed much earlier.
Privacy by Design (PbD)
An approach to systems engineering that aims to embed privacy into the design and operation of IT systems, networked infrastructure, and business practices from the initial stages.
- Proactive, not reactive; preventative, not remedial.
- Privacy is embedded into design.
- Offers full lifecycle protection.
Memory trick: Privacy by Design: Build it in, don't bolt it on.