What is privacy by design in AI governance?

• A. Marketing privacy to customers without changing data handling.
• B. Embedding data privacy controls and minimization into every stage of the AI lifecycle, from data collection to deployment and monitoring.
• C. Relying on post-deployment privacy patches.
• D. Ignoring privacy in early data collection.

Answer: (B)

Privacy by design means weaving privacy protections into every stage of the AI lifecycle from the start, so the system is built to protect individuals’ data by default. It focuses on reducing data use and exposure from the outset, and embedding privacy controls—such as data minimization, access controls, encryption, and secure processing—through data collection, processing, deployment, and ongoing monitoring. This proactive, holistic approach helps ensure accountability, regulatory compliance, and lower risk because privacy protections are part of the architecture, not an afterthought added later.

That’s why the best choice emphasizes embedding data privacy controls and minimization at every stage—from data collection to deployment and monitoring. The other options miss this proactive integration: marketing privacy without changing data handling is just promotion, post-deployment patches are reactive and insufficient, and ignoring privacy in early data collection ignores the foundational decisions that drive risk.