Privacy Engineering

Privacy engineering turns privacy goals into system behavior you can design, build, test, and operate. It connects policy and risk decisions to data flows, requirements, controls, and evidence.

The subject starts with people, not databases. A system can create a privacy problem even when nobody breaks in. Expected processing can still surprise people, deny them meaningful choices, expose sensitive inferences, or make correction and deletion impractical.

Security remains essential. It protects data against unauthorized access, alteration, loss, and disruption. Privacy engineering asks an additional question: can authorized processing itself create unacceptable consequences for people?

This course gives you a practical mental model. It does not decide which law applies or replace legal and privacy specialists. It shows you how to make approved privacy outcomes real in a system.

Translate goals into system properties

High-level principles do not tell an engineer what to implement. A statement such as “collect only necessary data” needs a defined purpose, field-level decisions, default settings, retention behavior, and tests.

NIST uses three privacy engineering objectives to bridge this gap:

• Predictability: People, system owners, and operators can form reliable assumptions about personal data and its processing.
• Manageability: The system supports granular administration of personal data, including alteration, deletion, and selective disclosure.
• Disassociability: The system can process personal data or events without linking them to people or devices beyond operational need.

These objectives are not a universal control list. They help you ask what capabilities the system needs. The answer depends on the processing purpose, context, people affected, and risk.

For predictability, check whether notices, interfaces, APIs, and actual data flows tell the same story. For manageability, check whether a person or authorized operator can reach every relevant copy. For disassociability, check where identity is genuinely required and where aggregation, separation, or pseudonymous identifiers can reduce association.

Model processing as data actions