# data[].attributes.body
#privacy

# data[].attributes.attachment_link.title
Linee guida per lo sviluppo del software sicuro|Agenzia per l’Italia digitale

# data[].attributes.attachment_link.description
Le linee guida per lo sviluppo del software sicuro nella pubblica amministrazione si inseriscono nel contesto delle linee guida per la sicurezza ICT delle Pubbliche amministrazioni, aventi lo scopo di fornire indicazioni sulle misure da adottare in ciascuna componente della Mappa del Modello strateg…

# data[].attributes.attachment_link.readable_text
Til hovedinnhold

We use cookies

This website uses cookies. If a cookie is not essential to ensure the function of our website, it will not be stored on your unit unless you approve. Read more about our use of cookies in the footer (in Norwegian).

Essential cookies

These cookies support our core functionality pertaining to security. We consider these necessary and they are stored without prior approval.

Functionality of forms

These cookies are necessary if you wish to use forms on our website. Other functions on our website will not be affected if you do not consent. The choice you make in this category, is valid for until 90 days.

Web analytics

We are considering using a tool for web analytics based on cookies. Therefore, such cookies are currently not present.

You can withdraw your consent at any time, by selecting "Manage cookies" in the footer.

Save my options

Lukk

The Norwegian Data Protection Authority has developed these guidelines to help organisations understand and comply with the requirement of data protection by design and by default in article 25 of the General Data Protection Regulation. We have cooperated with security professionals and software developers in public and private sector among others.

These guidelines are primary intended for developers, software architects, project managers, testers, data protection officers and security advisors. Everybody who develops and contributes to the development of software containing or processing personal data.

Software development begins with an idea of creating a product that will help to simplify or improve the quality of a process or task. There are functional requirements to how the software should solve the task.

Background

Software development should follow a methodology with key activities to ensure that the final product is robust. There is some technical literature that focuses on security by design as part of developing software. However, there is less about data protection by design and by default as part of developing software. While working on this guide, we have used Microsoft Security Development Lifecycle (SDL), Secure Software Development LifeCycle (S-SDLC) and ENISA; Privacy and Data Protection by Design - from policy to engineering, as a starting point, and explored how to incorporate data protection principles, subject rights, and the requirements of the GDPR into every step of the process.

Seven activities in a continuous process

The circular diagram at the start of this guide contains the seven key activities in the process of developing software with data protection by design and by default. Each activity is depicted as a jigsaw piece or a step leading to the next activity in the circle. We chose a circle to illustrate because both software development and data protection are continuous processes.

This guide describes each activity in the process, alongside our recommendations on how to carry it out, and what measures we consider important to successfully comply with the requirement to build data protection by design and by default into software. However, this does not mean that each organisation must follow this process to the letter when building data protection into software. It is up to each organisation to decide which methodology to use, which measures, areas, and activities should be emphasised, and where to increase your efforts. The choice of methodology is typically influenced by the services provided, the industry, the type of software being developed, and considerations/perceptions relating to the organisation's own level of risk.

This guide should not dictate a strict, sequential, and rigid process for each activity in the development process. It should rather be adapted into the specific methodology the organisation has chosen to use. Organisations that develop and release software at a fast pace, should consider how the guide best can be used to ensure that basic data protection and security parameters are in place, and how, for example, data protection and security tests can be included in fully automated testing regimes.

Summary of the activities

The seven activities in this guide start with training. In the section on training, we cover the most important topics on which to provide training, why, how to do this, and which tools to use.

The section on requirements describe the measures needed to ensure data protection and security, the tolerance levels the organisation should set for data protection and security, and the need to assess both security risks and data protection implications.

The next section takes these requirements further, to design, by dividing them into data oriented and process oriented design requirements. During this activity, it is important that the organisation carries out both threat modelling and an analysis of the attack surfaces.

The coding activity underlines the importance of developers using approved tools and frameworks, disabling unsafe functions and modules, and regularly carrying out static code analysis and code review.

The section on testing involves a recommendation to test whether data protection and security requirements are implemented properly, a description of what sort of security testing should be carried out, and an explanation of the importance of threat modelling and analysing the attack surface.

Before release, an incident response plan should be established, and a full security review of the software should be carried out. Release is then approved and all relevant data from the entire development process are archived.

The final activity involves the maintenance of the software and the response to incidents. The organisation should be prepared to respond to incidents, personal data breaches, faults and attacks, and be capable of issuing updates, guidelines, and information to users and those affected by the software.

Profiling, automated decision-making, and personalised services have become part of our day-to-day lives. These trends often involve processing of personal data on a large scale. Users expect services to both be secure and safeguard their privacy in an effective manner. Businesses that take data protection issues seriously, build trust. Thus, strong data protection measures can be a competitive advantage.

Data protection legislation contains basic principles for safeguarding the privacy of data subjects. Data protection by design and by default helps ensure that the information systems we use fulfil these data protection principles, and that the systems safeguard the rights of data subjects.

Data protection by design, and data protection by default, are central requirements in the General Data Protection Regulation (GDPR) that apply from May 2018. This guide describes how to comply with these requirements. The data controller must comply with the requirements governing data protection by design during software development, and when ordering systems, solutions, and services. The requirements must accordingly also be included when entering into agreements with suppliers, and when using consultants.

Transparency is a principle in the new regulation, and it is crucial when building data protection into software. Transparency about the use of personal data involves providing information about what is being processed, by whom, why, how, and for how long it is kept. In order for data subjects to exercise their rights, organisations must be open about their processing of personal data. That way, the data subjects can make informed decisions about whether or not to use a software, and this ensures the legitimacy and effectiveness of the data controller.

Management commitment is crucial for making the decision to apply the principles of use data protection by design in the organisation's procurements and software development. Management must also ensure to provide sufficient resources for this task. Taking data protection into account throughout the development process is both cost-effective and more efficient than making changes to an existing piece of software. Enterprises that do not comply with the GDPR risk significant costs, in the form of both fines for breaking the law, liability to the data subjects, and loss of revenue resulting from damage to their reputations.

# data[].attributes.attachment_link.title
Software development with Data Protection by Design and by Default

# data[].attributes.attachment_link.description
Til hovedinnhold This website uses cookies. If a cookie is not essential to ensure the function of our website, it will not be stored on your unit unless you approve. Read more about our use of cookies in the footer (in Norwegian). These cookies support our core functionality pertaining to security.

# data[].attributes.body
"The Developer's Guide to GDPR provides a first approach to the main principles of GDPR and the different points of attention to consider when developing and deploying applications that respect the privacy of users. "

# data[].attributes.attachment_link.readable_text
> GDPR developer's guide

The Developer's Guide to GDPR provides a first approach to the main principles of GDPR and the different points of attention to consider when developing and deploying applications that respect the privacy of users.

If you have a GitHub account, you can participate in the Developer's Guide to GDPR. Your contribution will be reviewed by the CNIL before publication.

Contributing to the GDPR Developer's Guide

Documents associated to this theme

Les mots clés associés à cette thématique

# data[].attributes.attachment_link.description
The Developer's Guide to GDPR provides a first approach to the main principles of GDPR and the different points of attention to consider when developing and deploying applications that respect the privacy of users. If you have a GitHub account, you can participate in the Developer's Guide to GDPR.

# data[].attributes.headline
Consumer protection — Privacy by design for consumer goods and services — Part 1: High-level requirements

# data[].attributes.subject
Consumer protection — Privacy by design for consumer goods and services — Part 1: High-level requirements

# data[].attributes.attachment_link.description
Consumer protection — Privacy by design for consumer goods and services — Part 1: High-level requirements

# data[].attributes.body
Guidelines published by the Spanish Data Protection Authority.

# data[].attributes.attachment_link.readable_text
Breaking news regarding accountability

Basic tools for accountability compliance

The AEPD has developed tools and help material to assist with compliance with general data protection regulation for small businesses, entrepreneurs and developers, and other types of controllers. This section lists those tools that are common to all types of processing. In the section "Guides, reports and technical notes" you can find specific material that extends their scope to specific treatments, technologies or controllers.

In any case, controllers and processors should not forget to verify that they comply with all the requirements and obligations that guarantee compliance with GDPR and national rules on data protection.

Risk management and Impact Assessment regarding Data Protection

The following resources support the obligation to carry out a risk analysis of personal data processing, and in case that is needed, the obligation to carry out a data protection impact assessment:

There are more resources about risk management and DPIA in the main section: Risk management

Data Protection by Design and by Default

The following resources support the obligation to take into account, from the initial stages of definition and analysis of the processing, appropriate technical and organisational measures for ensuring, by design and by default, data protection principles implementation:

Personal Data Breach Management

The following resources support the obligation to implement incident recording and notification mechanisms in order to properly manage any possible breach.

Application sectors and technologies

In order to respond to sectors of activity or technologies that incorporate singularities in data processing, referenced is made below to resources of interest, both national and international, that can serve as support to comply with the principle of accountability. At this time, published materials and resources cover the following areas:

Anonymisation and Pseudonymisation

Guidelines and technical surveys

Posts

International recommendations and guidelines

Tools

Artificial Intelligence and automated decisions

Due to the big use of the artificial intelligence in biometrics, in the following link you can find some very interesting information about Biometrics

Guidelines and technical surveys

International recommendations and guidelines

Big data

International recommendations and guidelines

Biometrics

Due to the big use of the artificial intelligence in biometrics, in the following link you can find some very interesting information about Artificial Intelligence and automated decisions

Guidelines and technical surveys

Post

International recommendations and guidelines

Blockchain

Posts

Cloud computing

International recommendations and guidelines

Covid-19 Pandemic

Guidelines and technical surveys

Posts

International recommendations and guidelines

Data protection by design and by default

Guidelines and technical surveys

Posts

International recommendations and guidelines

Encryption and privacy

Posts

International recommendations and guidelines

Governance and data protection policies

Posts

International recommendations and guidelines

Internet and mobile systems

Guidelines and technical surveys

Posts

International recommendations and guidelines

Internet of Things (IoT) and Connected Systems

Guidelines and technical surveys

Posts

International recommendations and guidelines

Personal data breach and security

Guidelines and technical surveys

Tools

Templates and forms

Posts

International recommendations and guidelines

Public Administrations

Guidelines and technical surveys

Templates and forms

International recommendations and guidelines

Risk management

Guidelines and technical surveys

Tools

Templates and forms

Posts

International recommendations and guidelines

Telecommuting

Guidelines and technical surveys

Posts

International recommendations and guidelines

# data[].attributes.attachment_link.description
In order to promote and disseminate knowledge about risk management for the rights and freedoms of natural persons, the AEPD (Spanish Data Protection Authority) develops resources and tools to promote compliance with the RGPD, focusing attention on supporting SMEs and entrepreneurs.

# data[].attributes.headline
ENISA: Recommendations on shaping technology according to GDPR provisions - Exploring the notion of data protection by default

# data[].attributes.subject
ENISA: Recommendations on shaping technology according to GDPR provisions - Exploring the notion of data protection by default

# data[].attributes.attachment_link.readable_text
This report aims to shed some light on what the data-protection-by-default principle means in information technology design, what is the situation today, as well as how the new GDPR obligation could support controllers in selecting data-protection-friendly defaults.

# data[].attributes.attachment_link.title
Recommendations on shaping technology according to GDPR provisions - Exploring the notion of data protection by default

# data[].attributes.attachment_link.description
This report aims to shed some light on what the data-protection-by-default principle means in information technology design, what is the situation today, as well as how the new GDPR obligation could support controllers in selecting data-protection-friendly defaults.

# data[].attributes.headline
Consumer protection — Privacy by design for consumer goods and services — Part 2: Use cases

# data[].attributes.subject
Consumer protection — Privacy by design for consumer goods and services — Part 2: Use cases

# data[].attributes.attachment_link.description
Consumer protection - Privacy by design for consumer goods and services - Part 2: Use cases

# data[].attributes.attachment_link.readable_text
The innovation, opportunities and potential value to society of AI will not need emphasising to anyone reading this guidance.

Nor is there a need to underline the range of risks involved in the use of technologies that shift processing of personal data to complex computer systems with often opaque approaches and algorithms.

This guidance helps organisations mitigate the risks specifically arising from a data protection perspective, explaining how data protection principles apply to AI projects without losing sight of the benefits such projects can deliver.

What stands out in the following pages is that the underlying data protection questions for even the most complex AI project are much the same as with any new project. Is data being used fairly, lawfully and transparently? Do people understand how their data is being used? How is data being kept secure?

The legal principle of accountability, for instance, requires organisations to account for the risks arising from their processing of personal data -whether they are running a simple register of customers' contact details or operating a sophisticated AI system to predict future consumer demand.

Aspects of the guidance should act as an aide memoire to those running AI projects. There should be no surprises in the requirements for data protection impact assessments or of documenting decisions. The guidance offers support and methodologies on how best to approach this work.

Other aspects of the law require greater thought. Data minimisation, for instance, may seem at odds with systems that allow machine learning to conclude what information is necessary from large data sets. As the guidance sets out though, there need not be a conflict here, and there are several techniques that can ensure organisations only process the personal data needed for their purpose.

Similarly, transparency of processing, mitigating discrimination, and ensuring individual rights around potential automated decision-making can pose difficult questions. Aspects of this are complemented by our existing guidance 'Explaining decisions made with AI guidance', published with the Alan Turing Institute in May 2020.

The common element to these challenging areas, and perhaps the headline takeaway, is the value of considering data protection at an early stage. Mitigation of risks must come at the design stage: retrofitting compliance as an end-of-project bolt-on rarely leads to comfortable compliance or practical products. This guidance should accompany that early engagement with compliance, in a way that ultimately benefits the people whose data AI approaches rely on.

The development and use of AI within our society is growing and evolving, and it feels as though we are at the early stages of a long journey. We will continue to focus on AI developments and their implications for privacy by building on this foundational guidance, and continuing to offer tools that promote privacy by design to those developing and using AI.

I must end with an acknowledgment of the excellent work of one of the document's authors, Professor Reuben Binns. Prof Binns joined the ICO as part of a fellowship scheme designed to deepen my office's understanding of this complex area, as part of our strategic priority of enabling good practice in AI. His time at the ICO, and this guidance in particular, is testament to the success of that fellowship, and we wish Prof Binns the best as he continues his career as Associate Professor of Computer Science at the University of Oxford.

---

Give your feedback

We will continue to develop this guidance to ensure it stays relevant.

We would like to continue to consult with those using the guidance to understand how it works in practice and ensure it remains relevant and consistent with emerging developments.

We are also interested in what tools the ICO could create to compliment the guidance and support you to implement it in practice.

If you would like to contribute to future consultations please provide your details below.

# data[].attributes.attachment_link.description
The innovation, opportunities and potential value to society of AI will not need emphasising to anyone reading this guidance.