Employing Privacy by Design principles in the application lifecycle’s planning stage helps ensure data privacy compliance throughout the rest of the lifecycle.
This article was originally published on the Delphix website
here July 29, 2024.
A Quick Overview of the Application Lifecycle Stages
Data privacy regulations such as GDPR, CCPA and HIPAA place requirements on application teams throughout the several stages of the application’s lifecycle. For the majority of this blog, we’ll focus on planning and how data privacy requirements impact planning. But first, here’s an overview of each stage.
Planning
As the first stage of the application lifecycle, the planning stage sets the tone for application development. It includes collecting business requirements and determining the application's goals, user needs, and technical specifications. There are also design activities such as creating architectural and system designs based on the requirements.
Development
This includes writing and assembling the application's codebase using suitable programming languages, frameworks, and tools. It also often includes unit testing, especially as quality is shifted left into development to provide faster feedback and defect correction. This is where DevOps test data management (TDM) first comes into play for most development teams.
Testing
This includes conducting various tests to identify bugs or issues in the application. Types of testing may include unit, integration, system, acceptance, and performance testing. This is where DevOps TDM plays its biggest role for most teams.
Deployment
This is where the application is released into a production environment to become accessible to end-users. This may involve CI/CD pipelines, configuration management, and scaling strategies.
Maintenance & Support
This is where post-deployment issues are addressed, such as updating features, fixing bugs, and ensuring consistent application performance and security. This is another area where DevOps TDM plays a role, as second- and third-level support personnel often use test data to reproduce and resolve issues.
Monitoring & Feedback
Here we observe application performance, gather user feedback, and analyze usage metrics to identify potential improvements or new features.
Decommissioning
Here we phase out the application when it's no longer needed or replace it with a newer system, while ensuring data migration or archival. This is the final stage where DevOps TDM often plays a part.
Why Data Privacy Regulations Are Important Across the Lifecycle
Each application lifecycle stage shares the importance of accountability to data privacy regulations., Examples include:
Compliance requirements fall on application teams at each stage of the application lifecycle. And it’s important for these teams to take those requirements into consideration as they undertake each stage. After all, non-compliance carries heavy penalties such as steep fines and potential jail time, depending on the regulation.
In charting out the course of application creation and management, the planning stage also contains key regulatory privacy requirements. Application teams must carry out the planning stage with these requirements in mind to ensure successful, compliant application creation.
Specific Data Privacy Concerns in Application Planning
During the planning stage, application teams must first assess if they have or will have data that is subject to privacy regulations. This can get complicated, as data privacy regulations cover many types of sensitive data.
The most common types of data covered in data privacy regulations include the following:
Personal data (general PII)
PII is any information that can be used to directly or indirectly identify a person. This includes fields such as names, addresses (physical, email, or IP), phone numbers, and identification numbers (e.g., social security number, passport number).
Sensitive personal data
Special categories of personal data that are given extra protection, often including race or ethnic origin, political opinions, religious or philosophical beliefs, genetic or biometric data (e.g., fingerprints, facial recognition), sexual orientation, and health information (e.g., medical records).
Financial information
Data related to banking, credit cards, and financial transactions, often including bank account numbers, credit card numbers, and transaction histories. Note that financial information may fall under the scope of non-regulatory mandates such as industry standards (such as the Payment Card Industry Data Security Standard (PCI DSS) and ISO 27001).
Health information
Personal medical data protected by regulations such as HIPAA (Health Insurance Portability and Accountability Act) in the U.S. Often includes health records and conditions, prescription data, and insurance information.
Children’s data
Data relating to children may be subject to extra protection depending on the jurisdiction. Regulations like the Children’s Online Privacy Protection Act (COPPA) apply.
Location data
Location data includes information about a person's precise location or movements, such as GPS data.
User preferences & behavioral data
This includes data collected from users’ online activities, preferences, browsing history, and habits.
Employee data
Personal information about employees that employers collect and maintain, including payroll, performance, and employment history.
Biometric data
Data derived from biometric processes, like fingerprints, facial recognition, retina scans, etc.
Beyond the types of data, teams must also understand the jurisdictions in which they operate and/or the citizens and residents from whom they capture PII. This will determine the specific regulations or laws that apply.
Regulatory jurisdictions are complex. For example, GDPR applies not only to businesses operating within the EU but also to businesses offering services to individuals in the EU and organizations outside of the EU monitoring the behavior of EU individuals. This is why most online businesses work to comply with GDPR, even if they are not based in the EU.
Sneak Preview: The 2024 State of Data Compliance and Security Report
There’s a perfect storm hitting non-production environments. The sensitive data footprint is sprawling. Cyberattacks and data breaches are on the rise. And there are increasing and ever-growing regulatory pressures.
Watch the on-demand webinar and get a sneak preview of what 200+ global enterprise leaders revealed in The 2024 State of Data Compliance and Security Report.
Watch the Sneak Preview >>
Why Privacy by Design Is Important in Application Planning
It’s important to implement data protection principles from the start of the application lifecycle. Ensuring privacy features are built-in rather than added as an afterthought is what’s referred to as Privacy by Design (Privacy by Design).
Privacy by Design is a concept that was developed by Ann Cavoukian, former Information and Privacy Commissioner of Ontario, Canada. It is a proactive approach to privacy and data protection in the development of products, processes, and systems.
The main tenets of PbD are outlined in seven foundational principles:
Proactive and preventative
Privacy measures should be anticipated and preventive, not just remedies for privacy invasions. This principle emphasizes taking proactive steps to prevent breaches and violations before they occur.
Privacy as the default setting
Privacy should be built into systems and practices by default without requiring individuals to take actions to secure their privacy. This ensures that personal data is automatically protected in all IT systems and business practices.
Privacy embedded into design
Privacy should be an integral part of the design and architecture of IT systems and business practices. It is not an add-on but an essential component of the core functionality being delivered.
Full functionality
Privacy by Design seeks to accommodate all legitimate interests and objectives in a "win-win" manner rather than forcing trade-offs between privacy and security. This principle advocates for "positive-sum" solutions rather than "zero-sum" ones involving unnecessary compromises.
End-to-end security
Privacy measures should extend throughout the entire lifecycle of the data involved, from initial collection to the final destruction of the data in a secure manner. Secure data management practices are essential at every stage.
Visibility and transparency
Organizations should be open about their privacy practices and technologies. This involves ensuring all stakeholders are informed about how personal data is handled, and visibility and transparency are key to accountability and trust.
Respect for user privacy
Privacy by Design prioritizes user privacy and keeps the individual's interests at the forefront. This includes offering strong privacy defaults, appropriate notice, and empowering user-friendly options.
Privacy by Design has been influential in guiding how organizations approach privacy and is incorporated into various privacy laws and regulations around the world, including GDPR. These principles also guide the development of technologies and systems that respect privacy by embedding Privacy by Design into their design, ensuring compliance and protecting users' rights.
What Are the Specific Privacy Requirements for Online Applications?
So, what are some of the specific privacy requirements that are commonly included in an application’s design? While these depend on the types of data involved, their jurisdictions and the applicable privacy laws, there are several requirements that should generally be met regardless of the aforementioned criteria.
These can generally be separated into four categories:
1. Data Collection and Retention
First, some requirements concern the ways in which data is collected and retained.
Data Minimization
Your application and business processes should collect only the data needed for the application's purpose and no more. Eliminate unnecessary or redundant data collection. The more data you collect, the greater your risk exposure and the more protection that will be required.
For example, a loan approval application may require a social security number for the processing of the request. But it may not be necessary to retain the social security number once the application has been approved or declined. In this case, the application does not need to retain the number indefinitely.
Access Controls
You must design the appropriate and effective role-based access controls to limit data exposure to only authorized users (i.e., those with a legitimate need to know). This means you need to define the user roles, consider their need to know sensitive details, and restrict access accordingly. These business rules should be documented as part of the design, as well.
Data Retention Policies
You must define data retention and deletion policies in alignment with regulatory requirements and user expectations. Those policies must be communicated (or viewable) to the individuals from whom you collect and store PII.
2. Data Protection
Second, some general requirements concern the ways in which data is protected:
Data encryption
Few privacy regulations mandate the use of encryption. For example, GDPR mentions encryption as a means of protecting personal data and requires organizations to implement security measures like encryption based on a risk assessment. While encryption itself isn't strictly mandated, GDPR requires data controllers and processors to consider it as part of their technical measures. Other mandates, such as PCI DSS and the New York Department of Financial Services (NYDFS) Cybersecurity Regulation, specifically require encryption.
Regardless, you should consider data encryption (both in transit and at rest) to protect sensitive information based on the risk and the protection encryption affords. At a minimum, network-layer encryption, such as Transport Layer Security (TLS), should be used to protect data in transit, especially over public networks.
So, let's compare data encryption vs. data masking.
Data anonymization or masking
Similar to data encryption, few regulations mandate the use of anonymization techniques. Data masking is, however, included in the international security standard ISO 27001. However, PII data masking often allows you to use PII in a way that is not otherwise feasible, such as data sharing, data analytics, or AI model training (which is especially important for data privacy in AI). Other mandates call for the use of data masking of a different kind: dynamic data masking. For example, PCI DSS requires the dynamic masking of primary account numbers (PANs) when displayed on screens, printed outputs or other forms. This is why printed sales receipts only show the last four digits of your credit card number.
Secure architecture and design
In addition to the security and privacy features cited above, you must design secure architectures to prevent unauthorized access and data breaches.
3. Data Rights Management
Some requirements concern the rights of users whose data is collected:
User consent management
To comply with many regulations, you must include mechanisms for obtaining, recording and managing your users’ consent to collect their personal information. If your users decline to consent, you must not collect and store their personal information, even if this means denying them service.
Data portability
You must provide ways for users to easily request, export, and transfer their data. This generally includes providing a simple and easily accessible interface where users can request their data, often as a dedicated section in the user account settings. You must also implement strong authentication mechanisms to verify the identity of users requesting data to prevent unauthorized access.
4. Accountability Measures
Some requirements concern accountability measures on the part of the data collectors:
Impact assessments
You must regularly conduct data protection impact assessments (DPIAs) to identify and mitigate potential privacy risks. The regulations sometimes do not specify a specific assessment frequency (e.g., annually) but require an assessment before beginning any new high-risk processing activity and an updated assessment if changes occur in the processing operations.
Audit trails
You must record data access and changes for compliance and auditing purposes. This may include application-level audit trails, such as tracking when and how end users access PII.
Third-party compliance
You must ensure that any third-party services or APIs used in the application comply with data privacy regulations. This may include appropriate provisions in contracts (and data processing agreements, or DPAs), regular audits of your vendors, continuous monitoring of vendor performance, and compliance certifications of vendors.
Ensure Data Privacy Compliance in Application Planning With Delphix
As you can see, online applications come with a lot of considerations. Addressing these in the planning stage will give your teams peace of mind. Employing a comprehensive data privacy compliance solution such as Delphix by Perforce’s Continuous Compliance solution can help your organization address all four sets of the aforementioned privacy requirements.
Continuous Compliance works by discovering sensitive data across an enterprise. It then irreversibly replaces original data values with fictitious but realistic equivalents. This automatically ensures that all sensitive data (PII, PHI, etc.) complies with any data privacy regulation, since masked data does not, in fact, represent the information of an actual customer, partner, employee, etc.
Delphix by Perforce’s Continuous Compliance solution eliminates the risk of personal data exposure in the event of a breach, since masked data is no longer real data. This also allows for more open access controls. Yet this data retains most of the utility that its original version possessed, allowing developers to work just as easily with it as with original data values.
Using Continuous Compliance in application lifecycle planning lets software teams achieve peace of mind early on during the application lifecycle. Not having to worry about sensitive data floating around an enterprise allows them to focus on other tasks and processes.
Ready to explore how Delphix can help you with your compliance operations? Request a demo or talk to our team about your needs. Delphix can help with your compliance operations.