Which statement best describes compliance-by-design in CDX implementations?

• A. Retrofitting regulatory and privacy controls after deployment.
• B. Embedding regulatory and privacy controls into the design and development process from the start.
• C. Compliance can be ignored in design.
• D. Relying solely on post-deployment audits for compliance.

Answer: (B)

Compliance-by-design means weaving regulatory and privacy controls into the design and development process from the start. In CDX implementations, this approach makes sure data handling—what data is collected, why it’s processed, who can access it, how long it’s kept, and how it’s logged—meets legal and policy requirements as the system is built. By embedding safeguards such as data minimization, purpose limitation, consent management, robust access controls, and built-in audit trails into the architecture and SDLC, you validate compliance through design reviews, modeling, and testing rather than scrambling to fix issues after launch. This reduces the risk of gaps, lowers the likelihood of costly rework, and helps avoid penalties or trust damage from non-compliance. In contrast, retrofitting after deployment introduces gaps and delays, ignoring compliance invites serious risk, and relying only on post-deployment audits can miss issues entirely and won’t prevent non-compliance during operation.