Privacy by design
Building privacy into the product from the first sketch instead of patching it in before launch. Defaults process only what the purpose needs.
See it
What it is
Privacy by design means the privacy decisions get made while you are still drawing boxes, not during the legal review two weeks before launch. The term comes from Ann Cavoukian's seven principles in the 1990s and landed in law as GDPR Article 25, which pairs it with privacy by default: out of the box, the settings must limit processing to what each stated purpose actually needs, instead of making people hunt for the toggle that stops it. That is not a rule that every kind of sharing needs an opt-in. Sharing that is genuinely necessary to run the service can ride on another lawful basis; what the default cannot do is quietly widen the processing beyond the purpose.
In product terms it looks like architecture, not policy. Profiles default to private. Analytics events carry IDs instead of email addresses. Deletion is a real code path shipped with the feature, not a ticket for support. Tokens instead of card numbers, aggregates instead of raw rows, on-device processing where it works at all. If a feature cannot be built without a new category of sensitive data, that is a design conversation while it is still cheap.
Gotcha: it fails as a slogan and works as a checklist. Attach a one-screen privacy review to the design doc template (what data, what purpose, what lawful basis, where it goes, how long it lives, how it gets deleted) and it becomes real. Say it at an all-hands and nothing changes, because retrofitting privacy is expensive precisely when the schema, the vendors, and the exports already exist.
Ask AI for it
Run a privacy by design review on this feature spec before we build it. For each step of the flow, list the personal data touched, the purpose, the lawful basis, where it is stored and who it is shared with, the retention period, and the deletion path. Then propose the more private architecture for each: pseudonymous IDs instead of emails, aggregation or on-device processing instead of raw collection, defaults that limit processing to what each stated purpose needs, and shorter retention. End with a checklist of concrete changes to the spec and the UI copy needed for any consent or notice.