# Privacy Design Patterns Standards and References

## Academic Foundation

### Hoepman's Privacy Design Strategies (2014)
Hoepman, J.-H. "Privacy Design Strategies." IFIP International Information Security Conference. Introduced the eight privacy design strategies (minimize, hide, separate, abstract, inform, control, enforce, demonstrate) as a bridge between high-level privacy principles and concrete design patterns.

### Extended Framework (2022)
Hoepman, J.-H. "Privacy Design Strategies: The Eight Strategies for GDPR Compliance." Published as a comprehensive reference mapping the eight strategies to GDPR articles, with practical implementation guidance and sub-patterns for each strategy.

## GDPR Regulatory Basis

### Article 25(1) — Data Protection by Design
The controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles.

### Article 25(2) — Data Protection by Default
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.

### EDPB Guidelines 4/2019 on Article 25
Provides detailed guidance on implementing data protection by design and by default. Maps technical measures to GDPR principles and identifies privacy design patterns as implementation mechanisms.

## Related Pattern Catalogs

### Privacy Patterns (privacypatterns.org)
Community-maintained catalog of privacy design patterns organized by strategy. Includes patterns for user interfaces, system architecture, and data management.

### LINDDUN Mitigation Strategies
The LINDDUN threat modeling methodology includes a catalog of privacy design patterns mapped to specific privacy threats. Patterns are organized by the threat category they mitigate.

### OWASP Privacy by Design
OWASP guidance on embedding privacy into the software development lifecycle, including architecture review checklists and design pattern recommendations.

## ISO Standards

### ISO/IEC 27701:2019 — Privacy Information Management
Provides a framework for implementing privacy controls within an information security management system. Sections 7.2-7.5 map to the eight privacy design patterns.

### ISO 31700:2023 — Privacy by Design for Consumer Goods
Specifies requirements for embedding privacy into the design of consumer products and services. References design patterns as implementation mechanisms.