Frameworks, guidance, publications, and models for practical security architecture.
Assured ControlEnterprise Security Architecture

Privacy Domain Model

Explore how natural persons, their information, the data it becomes, the laws that protect it, and the actors that process or threaten it relate.

Interactive Privacy Domain Model

Choose a domain or select any concept to reveal its definition and relationships.

Open full screen

Use the domain filters to focus the model. Select a concept to spotlight its connections; select it again, click the background, or press Escape to reset.

Understanding Privacy Through A Domain Model

Privacy is a connected system of people, information, law, processing, accountability, and risk.

The Privacy Domain Model starts with the natural person and the attributes and information that describe them. It traces how recorded information becomes data, how that data is classified and stored, and how jurisdiction, legislation, regulation, principles, and rights shape its use. It also connects controllers, processors, purposes, assessments, transfers, and the threat conditions that can lead to theft or misuse.

How To Use It

  1. Start with the natural person, the attributes that describe them, and the rights provided by applicable regulation.
  2. Trace how information becomes recorded data and how classification determines the protection it needs.
  3. Follow where data is stored, which assets contain it, and which jurisdiction and legislation apply.
  4. Explore how controllers engage processors and how processing, purpose, DPIAs, and international transfers connect.
  5. Use the principles, compliance requirements, enforcement mechanisms, DPO, and supervisory authority to explore accountability.
  6. Examine how motivation, access opportunity, and capability combine to realise privacy threats and initiate events.

Model Domains

DomainWhat It Helps Explain
Data subject & rightsHow natural persons, their attributes, and their enforceable privacy rights relate.
Information & dataHow information becomes data, is classified, stored, contained in assets, and located within a jurisdiction.
Legal & regulatoryHow legislation, regulation, compliance requirements, enforcement mechanisms, and supervisory authorities govern personal data.
Privacy principlesHow lawfulness, fairness, transparency, and respect for fundamental rights govern processing.
Controllers & processingHow controllers, processors, DPOs, DPIAs, purposes, processing activities, and international transfers connect.
Threat modelHow motivation, access opportunity, and capability enable event agents to realise threats and initiate specific events.

Supporting Downloads

Static editions of the model are available for reading, workshops, presentations, and adaptation.

Privacy Domain Model PDFPDF Privacy Domain Model SVGSVG Privacy Domain Model PNGPNG Privacy Domain Model JPGJPG Privacy Domain Model VisioVDX