Privacy in the product design lifecycle

About this guidance

This guidance is written for technology professionals such as product and UX designers, software engineers, QA testers, and product managers. It assumes your organisation acts as a data controller. Companies whose software, products, apps, or websites collect, manage, or share people’s personal information are likely to meet this definition. If your organisation acts as data controller, the organisation is responsible for complying with data protection law. Data protection obligations vary for organisations that fall outside this category, such as those that act as processors for personal information.

This guidance will help you, as technology professionals, understand how to incorporate data protection by default and design in your development of a technology product or service. It is not a substitute for detailed ICO guidance, but is intended to help you understand how to navigate and apply our more detailed guidance throughout the product design lifecycle.

To help you to understand the law and good practice as clearly as possible, this guidance says what organisations must, should, and could do to comply.

Legislative requirements

Must refers to legislative requirements.

Good practice

• Should does not refer to a legislative requirement, but what we expect you to do to comply effectively with the law. You should do this unless there is a good reason not to. If you choose to take a different approach, you must be able to demonstrate that this approach also complies with the law.
• Could refers to an option or example that you could consider to help you to comply effectively. There are likely to be various other ways you could comply.

This approach only applies where indicated in our guidance. We will update other guidance in due course.