Introduction

0.1 General

This document provides the component and subsystems developers with an early formalized process for identification of privacy objectives and requirements, as well as the necessary guidance on associated assessment. It further provides support for understanding the cascaded liability and obligation of manufacturers and service providers (Reference to GDPR and as applicable reference to Article 25, as well as to rules applicable to governmental applications).

The General Data Protection Regulation, in its Art. Twenty-five charges data controllers, and implicitly manufacturers, with implementing Data Protection by design and by default.

The aim of this document is to give requirements to manufacturers and/or service providers to implement Data protection and Privacy by Design and by Default (DPPbDD) early in the development of their products and services, i.e. before (or independently of) any specific application integration, to make sure that they are as privacy ready as possible with regard to the anticipated markets.

The quality management system of EN ISO 9001 provides a process framework through which products and services can incorporate Data protection and privacy by design. Annex C shows how EN ISO 9001 can be interpreted and extended for use in this domain where necessary. Control objectives and requirements have been derived from the General Data Protection Regulation, which the component manufacturer or software sub-systems or sub-service provider may choose to address. These clauses are applicable to the B2B market, since manufacturers composing these sub-components in larger systems will need to understand the limits and capabilities of each component, as part of their system design. Finally, a self-declaration mechanism is specified which can be used by component manufacturers and service providers as part of their attestation to system integrators of the capabilities, protections and limitations of that component or service.

For some purposes of processing and for some categories of personal data, a data protection impact assessment (DPIA) according to EN ISO/IEC 29134 needs to be conducted and in addition to the requirements given in this document, the treatment plan resulting from the DPIA needs to be fulfilled as well.

This document is intended to be used by manufacturers, suppliers, hard- and software developers providing products and services to system integrators who themselves intend to offer products and services to be used by data controllers and data processors. It allows system integrators to select and correctly use the offerings of sub-system and component suppliers and manufacturers when developing systems that may have data protection requirements.

0.2 Compatibility with management system standards

This document applies the framework developed by CEN/CENELEC and ISO to improve alignment among its Management System Standards. However, this document itself does not represent a Management System standard.

This document supports an organization to align or integrate its development considerations on data protection with the requirements of Management System standards.

BS EN 17529:2022

Data protection and privacy by design and by default

Current

Published:

31 Aug 2022