  Internet of Things (IoT) applications typically collect and analyse personal
data that can be used to derive sensitive information about individuals.
However, thus far, privacy concerns have not been explicitly considered in
software engineering processes when designing IoT applications. The advent of
behaviour driven security mechanisms, failing to address privacy concerns in
the design of IoT applications can have security implications. In this paper,
we explore how a Privacy-by-Design (PbD) framework, formulated as a set of
guidelines, can help software engineers integrate data privacy considerations
into the design of IoT applications. We studied the utility of this PbD
framework by studying how software engineers use it to design IoT applications.
We also explore the challenges in using the set of guidelines to influence the
IoT applications design process. In addition to highlighting the benefits of
having a PbD framework to make privacy features explicit during the design of
IoT applications, our studies also surfaced a number of challenges associated
with the approach. A key finding of our research is that the PbD framework
significantly increases both novice and expert software engineers' ability to
design privacy into IoT applications.

Software Engineering