Privacy by design: PIA and security from day one
privacy-by-design-pia-security-day-one
Privacy by design + PIA; security from day one — named NSW Design Standards. Complete and maintain a Privacy Impact Assessment; consent and data-use are explicit; identifiable vs de-identified access is separated. Security is designed and tested from the first release, not bolted on. Dual-cite USWDS earn-trust / data stewardship without merging the PIA/security-from-day-one names.
Description
Privacy by design plus PIA; security from day one—named NSW Design Standards. Complete and maintain a Privacy Impact Assessment; consent and data-use are explicit; identifiable vs de-identified access is separated. Security is designed and tested from the first release, not bolted on. Pass when a maintained PIA exists, consent and data-use are explicit, access is separated, and security is in the first release. Fail when there is no PIA, security is bolted on after launch, or identifiable and de-identified access are mixed.
When to use
Products handling personal data under NSW privacy and security standards.
Not when
No PIA, security bolted on after launch, or mixed identifiable access.
Agent hint
Complete a maintained PIA, separate identifiable access, and ship security day one.
A maintained PIA exists; consent/data-use are explicit; identifiable vs de-identified access is separated; security is in the first release.
No PIA; security bolted on after launch; identifiable and de-identified access mixed.
Citations
NSW Design Standards
https://www.digital.nsw.gov.au/delivery/digital-service-toolkit/design-standards