NIST Privacy Framework, Govern-PGV.PO-P2

Implement data protection by design and by default in every processing tool and process, and appoint a data protection officer where processing is carried out by a public authority, requires regular and systematic large scale monitoring of data subjects, or involves large scale processing of sensitive data or criminal records.

Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than fifty workers and none of the high-risk, non-occasional or special-category exceptions apply, and block rather than delete personal data pending any liability claim when you rectify or erase it.

Build data protection into the design of your processing and make it the default, and keep records of your processing activities.

Implement data protection by design and by default, including pseudonymization and data minimization, so that only the personal data necessary to each specific purpose is processed by default.

Implement appropriate technical and organisational measures, including data protection by design and by default, to secure personal data at a level appropriate to the risk and to be able to demonstrate compliance with the Act.

If enacted as drafted, a data controller or processor would have to implement personal data protection by design and by default, and would have to secure personal data with technical and organizational measures against unauthorized access, collection, use, disclosure, copying, modification, or destruction, and against the loss of any storage medium on which it is held.

Build data protection into the processing by design and by default, including pseudonymization, and process by default only the personal data necessary for each specific purpose.

Build data protection into the design and the default settings of your processing, restrict processing to persons acting under your authority and on your instructions, and take the measures necessary to secure personal data against loss, alteration, or unauthorized access, having regard to its nature and the risks the processing presents.

Secure personal data with the technical and organisational measures articles 37 to 41 require, determined from a risk, threat and vulnerability analysis, and build data protection into the design of your processing and make it the default.

Design your technical and organisational measures to implement the data protection principles, and ensure that by default only the personal data necessary for each specific purpose is processed.

Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent.

Guarantee the best interests of a child or adolescent in any processing of their data, and inform both the child and their parent or guardian, in clear and age appropriate language, before exercising the child's rights.

Where your online service is aimed at children, build in privacy-protective technical measures such as marking and filtering, write information for them in terms they can understand, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to a non-compliant site to keep them engaged.

Process a child's personal data in a manner that is in the best interest of the child, under Article 12.

Where you deploy an emerging technology such as artificial intelligence, the Internet of Things or blockchain to process personal data, set technical and organisational parameters that take account of safeguards for sensitive personal data, safeguards for child rights and other vulnerable groups, the right against solely automated decisions, the right to be forgotten, cross-border data flows, and privacy by design and by default.

Conduct regular data protection impact assessments to identify and mitigate privacy risks to children, and ensure data protection by design and by default when processing children's data.