Sample frameDay 331·Product · Privacy

Morning. Nobody in your company decided to collect that field. It went in one afternoon, and it's been collected ever since.

Product.

Privacy by Design

5 min read·Apply by lunch

The question

Open your signup form and your database side by side, and for every field you ask a new customer to hand over, name the decision your business would make differently if that box came back empty — then, once you've been through the lot, how many are left that you'd defend to the person who typed them in? Somebody chose every one of those fields. Very few of them were chosen on purpose.

The idea

Ann Cavoukian was Information and Privacy Commissioner of Ontario from 1997 to 2014. The groundwork came earlier: in 1995 the Ontario commissioner's office and the Dutch Registratiekamer jointly published Privacy-Enhancing Technologies: The Path to Anonymity, and the argument inside it became Privacy by Design, which Cavoukian set out as seven foundational principles in 2009. In October 2010 the International Conference of Data Protection and Privacy Commissioners, meeting in Jerusalem, adopted a resolution recognising it as an essential component of fundamental privacy protection. It now sits in law as Article 25 of the General Data Protection Regulation, in force across Europe since May 2018 under the heading data protection by design and by default. Two of the seven principles carry most of the weight. Privacy is the default setting, so a customer who never opens a settings screen is already protected. And privacy is embedded in the design rather than bolted on, which makes it an architecture decision instead of a policy one. The trap is the consent screen, because a tick box moves liability around without changing anything underneath it. By the time that screen exists, the decisions that mattered — what gets collected, what's switched on, how long rows are kept, who inside the company can read them — were made by whoever wrote the schema, months earlier, without anyone calling it a decision.

The framework

01
The field you added is a one-way door.
Adding a column takes a morning. Removing it takes a year, because by then it's in your backups, your warehouse, three vendor accounts and a spreadsheet somebody exported in March. Day 64's one-way doors apply here more cleanly than almost anywhere else in a product, so run the test at the point of collection, while it's still cheap: for every field on the form, name the decision your business would make differently because you hold it. The fields that survive that sentence are data. The rest is liability you're storing at your own expense.
02
Almost nobody opens the settings screen.
Whatever a product is set to on the day it ships is what most people will live with, and that isn't laziness — it's a reasonable reading that the setting is a recommendation. Eric Johnson and Daniel Goldstein put a size on this in Science in 2003, comparing organ-donor consent across European countries: where taking part was the default, consent ran near-universal; where people had to opt in, it stayed a small minority. Same populations, same paperwork, one word different. A default isn't a preference you set later. It's the decision, made once, for everyone who never reads it.
03
How long, and who actually deletes it?
A retention period that isn't a number of days is forever. Most companies have never set one, so every row ever written is still there, and the bill for that arrives exactly once — on the night somebody gets in, when what leaves is the whole history rather than the current quarter. Day 152 prices the blast radius of an automated system acting wrongly; this is the same sum for data sitting still. Write a number against each store, then check the harder half: whether a job actually runs, and whether it reaches the backups and the exports too.
04
Decide it in the spec, where it costs nothing.
Cavoukian's fourth principle refuses the trade outright — full functionality, positive-sum rather than zero-sum — on the grounds that privacy against features is a framing chosen by whoever would rather skip the work. The practical version is four lines in the definition of the thing: collected, defaults, retention, access, settled before anyone builds, because after launch each of them costs a migration and an email to every customer. And there's a floor under this now. Under Article 83, a failure of Article 25 is fineable up to ten million euros or two per cent of worldwide annual turnover, whichever is higher.

Members only · 4 principles + template + AI mentor

364 more frameworks are waiting.

Privacy by Design is Day 1 of 365. One framework every morning for a year — across strategy, sales, negotiation, leadership, and more.

$1 /day

Billed $365/yr · cancel any time

365 frameworks

12 topics · templates · AI mentor

Reserve your place — $365/yr →

One payment a year · the whole library · no auto-renewal.

More Product frameworks

All 22 product frameworks →