Privacy Engineering — purpose-bound data lifecycle

archimatev1

/01 Views

Governance and stewardshiparchimate

Collection and permitted usearchimate

Individual rights executionarchimate

Sharing and location constraintsarchimate

Retention and monitoringarchimate

Approved purpose and use policy → Consent and purpose validationarchimate

Approved purpose and use policy → Residency and jurisdiction checkarchimate

Consent and purpose validation → Retention schedule evaluatorarchimate

Determine applicable obligations → Erasure and disposition coordinatorarchimate

Transfer policy enforcement → Privacy disclosure monitorarchimate

Erasure and disposition coordinator → Purpose-scoped data recordsarchimate

/02 About

Privacy-by-design architecture for consent, lawful purposes, minimization, rights handling, retention, cross-boundary sharing and assurance.

Purpose: Privacy-by-design architecture for consent, lawful purposes, minimization, rights handling, retention, cross-boundary sharing and assurance. Architecture scope: independently reconstructed reference responsibilities, operational flows, policy decisions, assurance concerns, exception pathways and security boundaries. Grouped viewpoints describe coherent service or activity sequences. Focused trace views expose inter-domain obligations and information exchanges. Adoption: refine control and data-flow semantics to the enterprise ecosystem; map resource owners, role and workload identities, interfaces, failure policies, information classification, privacy obligations, deployment options and operational evidence. Reference elements alone do not establish an authorization, compliance result, formal proof, cryptographic assurance, or production readiness. Public conceptual basis: https://www.nist.gov/privacy-framework. This is an original Arq vendor-neutral interpretation, not an official implementation diagram or an endorsed/certified solution.

Published by Lattix · 20 elements · 21 relationships · validated on publish

/03 Contents

Role: Privacy controller
Policy: Approved purpose and use policy
Process: Privacy impact assessment
Data Domain: Personal information inventory
Application Component: Personal data intake, Consent and purpose validation, Data minimization guard, External sharing request, Residency and jurisdiction check, Transfer policy enforcement, Retention schedule evaluator, Erasure and disposition coordinator, Privacy disclosure monitor
Data Store: Purpose-scoped data records, Approved export records, Privacy rights and disposal evidence
Activity: Receive rights request, Verify requesting subject, Determine applicable obligations, Fulfill correction export or erasure