ISO/IEC 27706:2022 — Privacy by Design Engineering Requirements

1. ISO/IEC 27706:2022 — Privacy by Design Framework

ISO/IEC 27706:2022 provides requirements and guidelines for implementing privacy by design (PbD) throughout the lifecycle of systems, products, and services that process PII. While 27701 focuses on the management system (PIMS — the organisational and process framework), 27706 addresses the engineering and design practices needed to build privacy into systems from the ground up. It operationalises the privacy by design principles originally articulated by Dr. Ann Cavoukian (Information and Privacy Commissioner of Ontario, Canada), translating them into verifiable engineering requirements that can be integrated into standard software and systems development lifecycles including Agile, DevOps, and Waterfall methodologies.

The standard addresses a critical gap in privacy governance: while many organisations have privacy policies and compliance processes, they often lack the engineering practices needed to translate those policies into working systems. 27706 bridges this gap by providing concrete engineering guidance organised around Cavoukian’s seven foundational principles, making privacy by design practical, repeatable, and auditable. It applies to all organisations that develop, deploy, or operate systems processing PII, from startups building their first application to large enterprises managing complex privacy programmes.

2. Core Privacy by Design Principles (Operationalised)

The standard takes Cavoukian’s seven foundational principles and transforms them into actionable engineering requirements with specific implementation guidance for each phase of the system development lifecycle:

3. Privacy Engineering Process Requirements

The standard defines a structured privacy engineering process with five interconnected phases. Phase one, Privacy Requirements Elicitation, involves identifying applicable privacy regulations (GDPR, CCPA, PIPL, etc.), conducting stakeholder privacy analysis to understand data subject expectations, and documenting comprehensive PII data flows using data flow diagrams or data mapping tools. Phase two, Privacy Risk Assessment, requires performing privacy-specific threat modelling using established frameworks such as LINDDUN (focusing on privacy threats: Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance) or PRIAM (Privacy Risk Assessment Methodology). Each threat must be evaluated for severity and likelihood from both organisational and data subject perspectives.

Phase three, Privacy Architecture Design, guides engineers in selecting appropriate privacy-enhancing technologies (PETs) including differential privacy for statistical databases, federated learning for distributed ML training, homomorphic encryption for encrypted computation (with careful consideration of performance overhead), zero-knowledge proofs for credential verification, and trusted execution environments for confidential computing. Phase four, Privacy Implementation and Verification, requires integrating privacy controls into source code, conducting privacy-focused code reviews (separate from security code reviews), and automating privacy regression tests that verify consent enforcement, data minimisation, and retention limit compliance. Phase five, Privacy Validation, involves conducting privacy acceptance testing with representative users, performing privacy audit walkthroughs with internal or external auditors, and maintaining a comprehensive privacy evidence file that documents all privacy decisions, implementations, and testing results for regulatory demonstration.

4. Privacy-Enhancing Technologies (PETs) in Practice

ISO/IEC 27706 provides detailed guidance on applying PETs in real-world systems, including their strengths, limitations, and appropriate use cases. Differential privacy adds calibrated noise to query results to protect individual records while maintaining statistical utility — it is particularly useful for analytics on user behaviour data, health research, and smart city data aggregation. The standard emphasises that the privacy budget (epsilon, epsilon) must be carefully managed across multiple queries to prevent cumulative privacy loss. Federated learning trains machine learning models across decentralised data without raw data leaving user devices — applicable to keyboard prediction, health monitoring, and recommendation systems where data sensitivity is high. Homomorphic encryption enables computation on encrypted data without decryption, though the computational overhead (typically 10,000-1,000,000x for fully homomorphic encryption) limits current application to specific use cases such as encrypted search, private set intersection, and aggregated statistics. The standard advises engineers to select PETs based on a systematic privacy-utility-performance trade-off analysis rather than on theoretical privacy guarantees alone, and to validate implementations against realistic adversary models and workload patterns.

The standard also addresses organisational enablers for PbD, including the need for privacy engineering training programmes, cross-functional privacy review boards, and privacy metrics and KPIs that track adoption and effectiveness of privacy controls. It recommends that organisations designate privacy champions within product teams, establish privacy communities of practice for knowledge sharing, and conduct regular privacy engineering maturity assessments to identify improvement opportunities.