02 — Capability · BC-1270.50
Privacy Engineering
Design the product so that it handles personal data the way the company promised — minimizing what it keeps, honoring individual rights and documenting data flows that regulators and customers can inspect.
- Privacy by Design
- Data Protection Engineering
- Subprocessor Management
In scope
- Privacy impact assessment of features
- Data flow mapping and subprocessor inventory
- Data subject rights handling inside the product
- Encryption and key management commitments to customers
Out of scope
- Privacy legal interpretation and regulatory filings (see BC-140 and BC-150)
- Tenant residency enforcement (see BC-1250)
Decomposes into · 4
- BC-1270.50.10Privacy Impact AssessmentAssess features that touch personal data before they ship and record the decisions and mitigations made.
- BC-1270.50.20Data Flow & Subprocessor MappingKeep an accurate map of where personal data goes, including every subprocessor, and notify customers when it changes.
- BC-1270.50.30Data Subject Rights FulfillmentBuild the product paths that let access, correction and deletion requests be honored within the statutory window.
- BC-1270.50.40Encryption & Key Management CommitmentsDefine and deliver what is encrypted, how keys are managed and which options customers control.