# Privacy Goals for the Data Lifecycle
## 2 Related Work
### Gdpr  
Another way to view privacy risk is through a legal lens. The GDPR, introduced in 2018, was arguably, highly instrumental in bringing privacy into the foreground of business decision making. GDPR brought considerable change in privacy law, and introduced a series of additional and new obligations on businesses to safeguard data, and indeed the users and data subjects. Because GDPR is a regulation, it has taken effect immediately in all member states within the EU from the effective date. This means that, in contrast to a directive, which must be enacted by each member state within the EU, the regulation is legally binding in its entirety from the effective date across all member states, no enactment at national or individual Country level is necessary [38]. Article 5 of GDPR sets out 7 principles:  
**Principle 1: Lawfulness, fairness and transparency**_Lawful_ : Businesses must define the legal basis under which data is processed (Article 6 and 9): _Fair_: Data must be processed fairly, with data subjects (_'users/customers'_) interest in mind: _Transparency_: Keeping data subject(s) informed about what data processing will be done, and why (Article 12), including informing them about how the data will be used in plain, easy to understand language (Articles 13 and 14; Recital 39)  
**Principle 2: Purpose Limitation** Establishing and communicating to the data subject the specific purpose for processing the data, before processing starts. Further, no processing beyond this original stated purpose is allowed without prior informed consent (Article 7, Recital 32)  
**Principle 3: Data Minimisation** Data collected should be adequate, relevant and not excessive. This means you should collect minimum data needed for the specified purpose (Article 25(2))  
**Principle 4: Accuracy** Data should be kept accurate and up to date  
**Principle 5: Storage Limitation** Data should only be kept for as long as absolutely necessary (Recital 39); anonymise, pseudonymise and delete data as soon as it is no longer needed for the original purpose (Article 25); and securely delete and/or destroy data no longer needed  
**Principle 6: Integrity and confidentiality**_Integrity_: Safeguard the accuracy and completeness of the data; _Confidentiality_: Process and store the data securely ensuring data is protected from harm, unauthorised or unlawful disclosure, use, modification, damage or access (Recital 39). Making sure staff are trained in how to safely and securely process data. _Security_: Ensure appropriate security measures are in place both technically and organisationally. This should include polices, processes and technical measures (Article 32)  
**Principle 7-Accountability** the business (_\"Data Processor\"_) must be able to demonstrate compliance with these principles.  
Through these principles, GDPR places a number of obligations on businesses, including an obligation to implement data protection by design and default (DDbDD) (Article 25), a requirement to keep a record of _\"processing activities\"_ (Article 30) and implementing\"appropriate security and confidentiality of the personal data\"_ (Recital 39, Article 5(f)), along with mandatory reporting of data breaches within 72 h (Article, 33(1)). The provisions brought in by GDPR also afford data subjects (_'users'_) extensive rights including, the right to be forgotten (Article 17), and stricter rules have been placed around consent. These state that consent must be freely given, explicit (Article 7), and provided by a _\"clear affirmative act\"_ (Recital 32) [39]. Furthermore, GDPR requires that businesses must assess privacy risk for any processing that could potentially result in \"high risk\" to the data subject(s) whose data is being processed (Article 35(1)) and to ensure appropriate safeguards are put in place to keep such data secure (Article 32). Thus, as part of any decision making around privacy, the legal provisions of GDPR will need to be taken into account.