in compliance with applicable SHALL include software retirement laws and regulations plan from a privacy viewpoint 2.3–Engineering Controls: Strict limits should be placed on each phase of data processing lifecycle engaged by the software under development, including: Limiting Collection; Collecting by Fair and Lawful Means; Collecting from Third Parties; Limiting Uses and Disclosures; Limiting Retention; Disposal, Destruction; and Redaction 3. Privacy 3.1–Holistic and Integrative: The OASIS PMRM Privacy Use Embedded into Privacy commitments must be Template or the more comprehensive Design in holistic and OASIS PMRM methodology [2013] integrative ways. for identifying and documenting privacy requirements. 3.2–Systematic and Auditable: A systematic approach should be contain description of business adopted that relies upon accepted model showing traceability of personal standards and process data flows for any data collected frameworks, and is amenable to through new software services under external review. development. 3.3–Review and Assess: SHALL include identification of Detailed privacy impact and risk privacy design principles assessments should be used as a SHALL contain a privacy architecture basis for design decisions. SHALL describe privacy UI/UX design 3.4–Human-Proof: The privacy SHALL define privacy metrics risks should be demonstrably minimized and not increase SHALL include human through operation, checklists for software misconfiguration, or error. engineering artifacts include privacy review reports (either in reviewed documents or in separate report)
in compliance with applicable laws and regulations 2.3–Engineering Controls: Strict limits should be placed on each phase of data processing lifecycle engaged by the software under development, including: Limiting Collection; Collecting by Fair and Lawful Means; Collecting from Third Parties; Limiting Uses and Disclosures; Limiting Retention; Disposal, Destruction; and Redaction SHALL include software retirement plan from a privacy viewpoint 3. Privacy Embedded into Design 3.1–Holistic and Integrative: Privacy commitments must be in holistic and integrative ways. 3.2–Systematic and Auditable: A systematic approach should be adopted that relies upon accepted standards and process frameworks, and is amenable to external review. 3.3–Review and Assess: Detailed privacy impact and risk assessments should be used as a basis for design decisions. 3.4–Human-Proof: The privacy risks should be demonstrably minimized and not increase through operation, misconfiguration, or error. The OASIS PMRM Privacy Use Template or the more comprehensive OASIS PMRM methodology [2013] for identifying and documenting privacy requirements. contain description of business model showing traceability of personal data flows for any data collected through new software services under development. SHALL include identification of privacy design principles SHALL contain a privacy architecture SHALL describe privacy UI/UX design SHALL define privacy metrics SHALL include human checklists for software engineering artifacts include privacy review reports (either in reviewed documents or in separate report)
pbd-se-v1_0-wd04%20R3%20-%20without%20Section%202.docx