{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Secure Development (SDLC) & Application Security"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aprivacy-no-privacy-by-design","description":"Because systems and products are built without embedding privacy controls at the architecture level, privacy protections are bolted on after launch rather than applied by default, so personal data is over-collected and exposed and costly manual remediation is required.","details":{"category":"privacy","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"privacy-no-privacy-by-design","taxonomies":["nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:privacy-no-privacy-by-design","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aprivacy-no-privacy-by-design","sourceIds":["aiuc-1","cobit-2019","eu-ai-act","hipaa","iso-27001","nist-800-53","soc2"],"sourceUrl":null,"title":"Absence of privacy-by-design and default","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2326220fa78f7045acf0ce6a3e6c1ecbc0dfee537671d89c59c9f5772eafb881","properties":{"rationale":"Eliciting and approving data-protection requirements before design embeds privacy at the requirements stage rather than bolting it on post-launch.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/risk-privacy-no-privacy-by-design-c9472484.json","targetId":"risk:privacy-no-privacy-by-design","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a4e55f5b21884fd049c6100e09b41b1e2376154542a09f0ebff3ddee69452b4","properties":{"rationale":"The minimum-necessary/data-minimization requirement is a core privacy-by-default principle reducing over-collection and exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-privacy-no-privacy-by-design-c9472484.json","targetId":"risk:privacy-no-privacy-by-design","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7b434d3f4332a24a50e4a02de5ab58154be569f36a0b740d44f56d522277df90","properties":{"rationale":"Applying data-protection and least-privilege principles at the architecture stage embeds privacy/security by design and default.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/risk-privacy-no-privacy-by-design-c9472484.json","targetId":"risk:privacy-no-privacy-by-design","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:910ecea2df45bd97d6d8e48d6a91183ff8a82ca6e1a502943fa5a9bb9230d579","properties":{"rationale":"Applying pseudonymization when full identifiers aren't required is a core privacy-by-design/default technique.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-12-c5a5999a.json","sourceId":"uc:UC-DATA-12","targetDetailPath":"/data/v1/records/risk-privacy-no-privacy-by-design-c9472484.json","targetId":"risk:privacy-no-privacy-by-design","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ec0bbc5a3bc96df0c3f32e2a388c424a1d009d80e79397671e79647833af3ea6","properties":{"rationale":"Identifying and resourcing privacy/security requirements at planning enables privacy engineering rather than post-launch remediation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-02-c3b003c2.json","sourceId":"uc:UC-SDLC-02","targetDetailPath":"/data/v1/records/risk-privacy-no-privacy-by-design-c9472484.json","targetId":"risk:privacy-no-privacy-by-design","type":"mitigates"}],"schemaVersion":1}