Privacy engineering
Privacy by Design
Privacy controls are embedded as system requirements rather than treated as a policy appendix. The prototype includes 34 design controls spanning collection, AI processing, third parties, decisioning, retention and data-subject operations.
34Design requirements
6HITL / source / cross-border / deletion
42Linked register
36Linked risk register
| ID | Control | Engineering requirement | Status |
|---|---|---|---|
| PBD-01 | Field-level minimization | Define required data fields per module; reject or mask unused fields. | Designed |
| PBD-02 | Raw-document segregation | Store raw images/documents in more restricted encrypted zone. | Designed |
| PBD-03 | Identifier tokenization | Use case tokens instead of direct identifiers in downstream analytics where possible. | Designed |
| PBD-04 | Source allowlist | Only approved external data sources/connectors may be invoked. | Designed |
| PBD-05 | Source-policy enforcement | Record permitted access method, ToS/robots policy and contract status. | Designed |
| PBD-06 | Evidence minimization | Retain specific decision evidence, not unnecessary full-source copies. | Designed |
| PBD-07 | TTL & freshness | Each derived finding has source timestamp and expiry/re-screen policy. | Designed |
| PBD-08 | Entity threshold | Ambiguous identity match is not treated as confirmed. | Designed |
| PBD-09 | Human review gate | High-impact probabilistic findings require analyst review. | Designed |
| PBD-10 | Reason codes | Every risk-driving output has human-readable reason code. | Designed |
| PBD-11 | No opaque auto-decline | Final adverse decisions cannot be based solely on uninterpretable model output. | Designed |
| PBD-12 | No secondary training | Case data excluded from vendor/model training unless separately approved. | Designed |
| PBD-13 | Telemetry minimization | Logs avoid raw documents, images, tokens and unnecessary personal data. | Designed |
| PBD-14 | Model bias testing | Test materially affected groups/language patterns where relevant and legally appropriate. | Designed |
| PBD-15 | RBAC/ABAC | Role and purpose-based authorization for analyst/admin access. | Designed |
| PBD-16 | PAM | Privileged access controlled and monitored. | Designed |
| PBD-17 | Encryption | TLS in transit and strong encryption at rest. | Designed |
| PBD-18 | Key separation | Separate key control for raw sensitive document store. | Designed |
| PBD-19 | Cross-border gate | No offshore processor/subprocessor until legal and security review passes. | Designed |
| PBD-20 | Deletion propagation | Deletion covers primary store, derived cache, search index and supported backups. | Designed |
| PBD-21 | Correction propagation | Corrected identity data invalidates stale findings and triggers re-score. | Designed |
| PBD-22 | DSR engineering | Search/export/correct/delete capabilities mapped to data stores. | Designed |
| PBD-23 | Dispute / reconsideration | Merchant can request review of incorrect risk-driving data. | Designed |
| PBD-24 | Processor controls | Instructions, confidentiality, security, audit and deletion obligations. | Designed |
| PBD-25 | Subprocessor inventory | Maintain approved subprocessor and data-location list. | Designed |
| PBD-26 | Retention by data class | Different retention for raw evidence vs derived decision records. | Designed |
| PBD-27 | Purpose-bound re-screening | Ongoing monitoring only when policy/legal basis allows. | Designed |
| PBD-28 | Change assessment | New connector/model/category triggers privacy/security impact review. | Designed |
| PBD-29 | Secure export | Analyst exports watermarked/logged and minimized. | Designed |
| PBD-30 | Evidence integrity | Hash/sign evidence snapshots where applicable. | Designed |
| PBD-31 | Audit completeness | Who/what/when/model/source/reason captured for decision reconstruction. | Designed |
| PBD-32 | Incident containment | Connector tokens, raw stores and model endpoints separately isolatable. | Designed |
| PBD-33 | Privacy metrics | Track minimization, deletion SLA, DSR SLA, false positive disputes. | Designed |
| PBD-34 | Go-live privacy gate | DPIA, ROPA, processor review and control test complete before production. | Designed |
Privacy Gate 1 · Design
Confirm purpose, data subjects, categories, source, legal basis candidate, minimization, recipients and residency before development.
Privacy Gate 2 · PoC
Use controlled test data, validate source ToS, measure false positives and verify no uncontrolled model-training reuse.
Privacy Gate 3 · Go-Live
DPIA residual risks accepted, ROPA complete, processor terms signed, retention/deletion tested, DSR and audit reconstruction tested.