Data protection by design in systems development: From legal requirements to technical solutions

Abstract

Data protection by design is a principle to systems development meaning that the protection of personal data is built into the systems design from the start. For many jurisdictions, this principle is becoming a legal requirement. Using a research approach based on design science, a framework is constructed helping systems developers achieve privacy by design in a systematic manner. The framework articulate how the business requirements can be captured, assessed, and implemented in the systems development. Examples of how the data protection principles can be concretely implemented is also presented.