TOMs and privacy by design: deriving safeguards from the risk

Controls are not a universal shopping list

Protection needs, likely scenarios, scale, technology and implementation costs all feed into the selection of appropriate measures. The decision must be traceable and must be reviewed again when things change.

Privacy-friendly defaults reduce operational risk

Access, visibility, logging, retention and export should already be limited in the design. Compliance then depends less on later manual corrections.

• Minimise data scope and default retention
• Manage roles and permissions with recertification
• Apply pseudonymisation and encryption on a risk basis
• Demonstrate effectiveness through tests and operational evidence