Design and Evaluation of a Focus Area Maturity Model for Privacy-by-Design

Privacy-by-design (PbD) considers privacy in the entire lifecycle of information systems and personal data. Although a wide variety of techniques for PbD exist, a framework that considers privacy in the full context of both systems design and organizational development remains absent. This research aims to design, validate, implement, and evaluate a PbD Focus Area Maturity Model as a guiding artifact for the application of PbD (PbD-MM). The PbD-MM was created using a design science approach. A set of previously coded PbD activities were used to formulate capabilities for the maturity matrix. The PbD-MM describes 14 focus areas and 60 capabilities, with their dependencies creating 10 maturity levels. The PbD-MM was validated through a focus group with PbD practitioners and implemented in a web application offering self-assessment and reporting. A total of 46 completed assessments were collected through online distribution. We find a broad basis of capabilities in PbD practice, with further developed governance and compliance, and a positive correlation between the highest-scoring focus area and higher overall maturity. The PbD-MM offers a structuring of PbD activities and an assessment instrument to support the development of organizational PbD capabilities.