Which practice aligns with privacy by design?

• A. Collect as much data as possible
• B. Delay privacy reviews
• C. Embed privacy controls from the start
• D. Expand data sharing with third parties

Answer: (C)

Privacy by design means embedding privacy considerations into the design and operation of a system from the outset, so protections are built in rather than added later. Embedding privacy controls from the start is exactly this approach: you build in privacy-friendly defaults, minimize the data you collect, restrict who can access it, and implement security measures upfront. This proactive stance reduces risk and helps meet privacy goals and compliance.

Collecting as much data as possible runs counter to this approach because it increases exposure and complexity, making privacy harder to manage. Delaying privacy reviews means issues aren’t addressed when they matter most, risking noncompliance and user trust. Expanding data sharing with third parties increases data exposure and reduces user control, which privacy by design aims to avoid.