Which statement best reflects privacy by design in PI work?

• A. Maximize data collection for completeness
• B. Delay privacy considerations until after data collection
• C. Minimize data collection, secure handling, and disposal
• D. Retain data indefinitely

Answer: (C)

Privacy by design means embedding protections into every step of the process from the start, especially in handling personal information. In PI work, this translates to only collecting what is truly needed, keeping data secure while it’s stored or transmitted, and disposing of it properly when it’s no longer required. This approach limits exposure and reduces risk by design.

Maximizing data collection increases the volume of information at risk, so it clashes with privacy by design. Delaying privacy considerations until after data collection makes safeguards harder to implement and may leave data vulnerable. Retaining data indefinitely runs counter to data minimization and can create ongoing risk and accountability issues. By focusing on minimal collection, secure handling, and proper disposal, the option aligns with the principle of privacy by design.