Privacy Engineering

Engineer the full data lifecycle from purpose through deletion.

Workflow

1. State the declared purpose for each material data category and reject speculative collection that has no concrete use.
2. Classify data sensitivity and map collection, processing, storage, access, sharing, derived copies, logs/telemetry, backups, and deletion.
3. Define minimization: collect only what the product requirement actually needs.
4. Define retention trigger and duration from accepted product/legal policy; do not invent jurisdiction-specific legal requirements.
5. Define consent/revocation behavior where applicable, including how system behavior changes after revocation.
6. Define deletion propagation across primary stores, replicas, caches, exports, traces, and derived datasets as required by the policy.
7. Convert privacy requirements into observable acceptance criteria and verify deletion/retention behavior rather than trusting documentation alone.
8. Route encryption/authz/secrets implementation to security-engineering and storage mechanics to database/platform specialists.

Stop