EN 17529:2022

SLOVENSKI STANDARD
01-september-2022
Varstvo podatkov in zasebnosti z načrtovanjem in kot privzeto
Data protection and privacy by design and by default
Datenschutz by Design und als Grundeinstellung
Protection des données et de la vie privée dès la conception et par défaut
Ta slovenski standard je istoveten z: EN 17529:2022
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD EN 17529
NORME EUROPÉENNE
EUROPÄISCHE NORM
May 2022
ICS 35.030
English version
Data protection and privacy by design and by default
Protection des données et de la vie privée dès la Datenschutz by Design und als Grundeinstellung
conception et par défaut
This European Standard was approved by CEN on 5 December 2021.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.

CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2022 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. EN 17529:2022 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 4
Introduction . 5
1 Scope . 6
2 Normative references . 6
3 Terms, definitions and abbreviations . 6
3.1 Terms and definitions . 6
3.2 Abbreviated terms . 7
4 General. 7
4.1 Preparing the grounds for data protection and privacy by design and by default . 7
4.2 Structure for disassembling product and service into applicable categories . 8
4.2.1 Introduction . 8
4.2.2 Product perspectives . 9
4.2.3 Service elements . 9
4.3 Self-declaration and levels of achievement . 10
5 Privacy-aware development of products and services . 12
5.1 Leadership and market intelligence . 12
5.2 Preparation . 13
5.3 Design . 13
5.3.1 Determination of DPPbDD requirements . 13
5.3.2 Development . 14
5.3.3 Production and service provision . 15
5.3.4 Release of products and services . 15
5.4 Performance evaluation . 15
5.5 Improvement . 15
6 Data protection capability requirements on the design of products and services . 15
6.1 Access . 15
6.1.1 Access to data . 15
6.1.2 Copy of data . 16
6.2 Accountability . 16
6.3 Accuracy . 17
6.4 Data de-identification . 18
6.5 Data minimization . 19
6.6 Data portability . 20
6.7 Confidentiality . 21
6.8 Erasure. 23
6.9 Consent and Children . 24
6.9.1 Determination of user age . 24
6.9.2 Configurable children age threshold . 24
6.10 Information security . 25
6.10.1 Unauthorized or unlawful processing . 25
6.10.2 Data loss . 28
6.10.3 Information protection targets . 29
6.10.4 Restore . 29
6.11 Lawfulness . 30
6.11.1 Data disclosure . 30
6.11.2 Consent . 30
6.12 Objection to processing . 31
6.13 Automated decision making . 32
6.14 Restriction of processing . 32
6.15 Storage limitation . 33
6.16 Transparency . 34
6.16.1 Information . 34
6.16.2 Record of processing activities . 37
7 Requirements to the self-declaration of privacy-aware design . 38
7.1 Process requirements . 38
7.1.1 Preparation based on the product perspective and service element requirements . 38
7.1.2 Additional considerations related to DPIAs . 38
7.1.3 Determination of the level of achievement . 38
7.2 Self-declaration statement . 39
Annex A (informative) Applicability mapping between Clause 6 requirements and
perspectives or elements . 41
Annex B (informative) Approach for a specification . 53
Annex C (informative) Guidelines related to EN ISO 9001 . 55
Annex ZA (informative) Relationship between this European Standard and the data
protection by design and by default requirements of Regulation EU 2016/679 aimed
to be covered . 60
Bibliography . 62

European foreword
This document (EN 17529:2022) has been prepared by WG 5 “Data Protection, Privacy and Identity
Management” of the CEN/CENELEC JTC 13 “Cybersecurity and Data Protection”, the secretariat of which
is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by November 2022, and conflicting national standards shall
be withdrawn at the latest by November 2022.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
This document has been prepared as part of CEN/CLC JTC 13 work programme, not only as the first
deliverable called by mandate M/530 given to CEN and CENELEC by the European Commission, but also
to be generic enough to be applicable to a variety of domains other than the security industry, which was
in focus of the mandate.
For relationship with EU Regulation(s), see informative Annex ZA, which is an integral part of this
document.
Any feedback and questions on this document should be directed to the users’ national standards body.
A complete listing of these bodies can be found on the CEN website.
According to the CEN-CENELEC Internal Regulations, the national standards organisations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia,
Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland,
Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North
Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United
Kingdom.
Introduction
0.1 General
This document provides the component and subsystems developers with an early formalized process for
identification of privacy objectives and requirements, as well as the necessary guidance on associated
assessment. It further provides support for understanding the cascaded liability and obligation of
manufacturers and service providers (Reference to GDPR and as applicable reference to Article 25, as
well as to rules applicable to governmental applications).
The General Data Protection Regulation, in its Art. Twenty-five charges data controllers, and implici
...