<!-- Source: screenata.com -->
<!-- Content type: AEO answer page -->
<!-- Topics: SOC 2, ISO 27001, HIPAA, HITRUST, CMMC, compliance evidence -->

---
question: "What are the 7 principles of privacy?"
title: "What Are the 7 Principles of Privacy"
seoTitle: "The 7 Principles of Privacy: GDPR vs Privacy by Design"
summary: "Two different lists are called the seven principles of privacy. GDPR Article 5 sets out seven data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Privacy by Design, developed by Ann Cavoukian, sets out seven foundational principles about building privacy into systems. GDPR is legally binding; Privacy by Design is a design philosophy that GDPR Article 25 partly codifies."
publishedAt: "2026-08-18"
keywords:
  - "7 principles of privacy"
  - "seven principles of GDPR"
  - "privacy by design principles"
  - "GDPR Article 5 principles"
  - "7 data protection principles"
  - "7 data policy principles"
pillar: "Beyond SOC 2"
faqs:
  - question: "What are the 7 principles of GDPR?"
    answer: "Article 5 lists lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Accountability is the one that requires you to demonstrate compliance, not merely achieve it."
  - question: "What are the 7 principles of Privacy by Design?"
    answer: "Proactive not reactive; privacy as the default setting; privacy embedded into design; full functionality as a positive-sum outcome; end-to-end security; visibility and transparency; and respect for user privacy. They were developed by Ann Cavoukian and are referenced in GDPR Article 25."
  - question: "Which list should I use?"
    answer: "GDPR Article 5 if you are answering a regulator, an auditor, or a security questionnaire, because it is legally binding. Privacy by Design if you are making engineering decisions about how a system should handle data."
---

## What are the 7 principles of privacy?

Two different lists carry this name. **GDPR Article 5** sets out seven data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. **Privacy by Design**, developed by Ann Cavoukian, sets out seven foundational principles for building privacy into systems. GDPR Article 5 is legally binding. Privacy by Design is a design philosophy that GDPR Article 25 partly codifies.

Which one you want depends on whether the context is legal or architectural.

## GDPR Article 5: the seven data protection principles

| Principle | What it requires |
|---|---|
| Lawfulness, fairness, transparency | A valid legal basis, and people are told what happens to their data |
| Purpose limitation | Collected for a stated purpose, not reused for an incompatible one |
| Data minimisation | Only what the purpose actually needs |
| Accuracy | Kept correct and updated, with a route to correction |
| Storage limitation | Retained only as long as the purpose requires |
| Integrity and confidentiality | Protected against unauthorised access, loss, and damage |
| Accountability | You can **demonstrate** the other six, not just satisfy them |

Accountability is the one that changes daily work. It converts every other principle into something that needs a record behind it, which is why GDPR programs generate documentation the way they do.

## Privacy by Design: the seven foundational principles

1. Proactive not reactive, preventative not remedial
2. Privacy as the default setting
3. Privacy embedded into design
4. Full functionality, a positive-sum rather than zero-sum outcome
5. End-to-end security across the full data lifecycle
6. Visibility and transparency, open to independent verification
7. Respect for user privacy, keeping it user-centric

Developed by Ann Cavoukian while Information and Privacy Commissioner of Ontario. It is a design philosophy rather than law, though GDPR **Article 25** gives part of it legal force under data protection by design and by default.

## Which one to cite

| Situation | Use |
|---|---|
| Regulator, auditor, or DPA question | GDPR Article 5 |
| Security questionnaire from an enterprise buyer | GDPR Article 5 |
| Engineering decisions about handling data | Privacy by Design |
| Explaining your approach to customers | Privacy by Design, with Article 5 for substantiation |

Citing the wrong one is not an error so much as a mismatch. A regulator asking about your principles wants Article 5. An engineer asking wants principles that survive contact with a schema design.

## How this connects to SOC 2 and ISO 27001

SOC 2 has an optional **Privacy** trust services category, and ISO 27701 extends ISO 27001 into a privacy information management system. Neither uses either list of seven verbatim, but both test the same underlying obligations: a lawful basis, minimisation, retention limits, protection, and the ability to demonstrate all of it. Accountability is again the criterion that generates the evidence.