 The privacy by design approach provides high-level guidelines in the form of principles for designing privacy-preserving systems. These principles have at their core that “data protection needs to be viewed in proactive rather than reactive terms, making privacy by design preventive and not simply remedial” (Cavoukian 2010). Privacy by design’s main point is that data protection should be central in all phases of product life cycles, from initial design to operational use and disposal (see Colesky et al. 2016) for a critical analysis of the privacy by design approach). The Privacy Impact Assessment approach proposed by Clarke (2009) makes a similar point. It proposes “a systematic process for evaluating the potential effects on privacy of a project, initiative or proposed system or scheme” (Clarke 2009). Note that these approaches should not only be seen as auditing approaches, but rather as a means to make privacy awareness and compliance an integral part of the organizational and engineering culture.