Privacy Threat Model: [System or feature name]

Privacy threat model for a system, service or feature, organised around the seven LINDDUN privacy threat categories (Linking, Identifying, Non-repudiation, Detecting, Data disclosure, Unawareness and unintervenability, Non-compliance) as published on linddun.org by the DistriNet research group at KU Leuven (category names checked in October 2026). It records the system description, a data flow diagram with trust boundaries, a personal data inventory, threat elicitation per category and diagram element, a threat register with severity, privacy-enhancing mitigations, residual risk and the link to the data protection impact assessment (DPIA). This is an engineering format, not legal advice. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Introduction and scope
2. System description
3. Data flow diagram
4. Personal data inventory
5. Threat elicitation
6. Threat register
7. Mitigations and privacy-enhancing technologies
8. Residual risk
9. Link to the DPIA
10. Appendices

1. Introduction and scope

This section states what the model covers and which processing purposes it assumes.

1.1 Purpose of the model

This model identifies privacy threats to the people whose data [System name] processes, rates them, and agrees mitigations before [release 4.0 / the change]. It complements the security threat model, which focuses on attackers against the system; here the concern also includes the operator, legitimate recipients and the system's own design.

1.2 Scope

1.3 Processing purposes

2. System description

[System name] lets users log workouts from their phone and wearable, share selected workouts with friends, and request a personal coach who sees their training history.

2.1 Actors

2.2 Main user journeys

1. Example: User records a run; GPS track and heart rate sync to the workout API.
2. Example: User shares a run with friends; friends see route map and pace.
3. Example: User requests a coach; matching service uses goal, age band and city.
4. [Journey]

2.3 Assumptions

• Example: Transport is TLS 1.2+ and storage is encrypted at rest (covered by the security threat model).
• Example: Coaches are contractually bound but not employees.
• [Assumption]

3. Data flow diagram

The diagram shows external entities (E), processes (P), data stores (DS) and numbered data flows (F). Grouped zones are trust boundaries.

4. Personal data inventory

5. Threat elicitation

Threats were elicited in [two 90-minute workshops on YYYY-MM-DD] with [engineering, product, the DPO and a user researcher].

5.1 Categories and prompts

The category names follow LINDDUN; the prompts are this template's own questions.

5.2 Elicitation matrix

Each cell holds the threat IDs found, or "n/a" with a reason in the notes.

Notes on "n/a" cells: Example: Non-repudiation is not relevant to the workout API because no action needs to be deniable by the user; revisit if anonymous feedback is added.

6. Threat register

Severity is the product of likelihood and impact on the data subject, each rated 1 to 4:

7. Mitigations and privacy-enhancing technologies

Mitigation strategies are listed from strongest to weakest: avoid the data, minimise it, separate or aggregate it, hide it, then inform and empower the person.

7.1 Mitigation plan

7.2 Privacy-enhancing technologies considered

For differential privacy, a mechanism satisfies $\varepsilon$-differential privacy when, for any two datasets $D$ and $D'$ that differ in one person and any output set $S$:

Smaller $\varepsilon$ means stronger privacy and noisier results; record the chosen value and the budget per release if it is adopted.

8. Residual risk

Overall conclusion: Example: After mitigations no residual threat is rated above Medium. Processing of health data (D-03) remains high risk by nature and is assessed in the DPIA.

9. Link to the DPIA

This model provides engineering evidence for [DPIA-2026-014]. The table maps its outputs to the DPIA.

Trigger a DPIA review when: [a new data category or purpose is added; a new recipient receives personal data; a residual risk is rated High].

10. Appendices

The appendices hold the glossary, rating scales and references.

10.1 Glossary

10.2 Rating scales

Severity bands: 1 to 3 Low, 4 to 8 Medium, 9 to 12 High, 13 to 16 Critical.

10.3 References

Standard and licence note

Based on the LINDDUN privacy threat modelling framework developed by the DistriNet research group at KU Leuven (https://linddun.org), using only its seven threat category names (Linking, Identifying, Non-repudiation, Detecting, Data disclosure, Unawareness and unintervenability, Non-compliance) as published on linddun.org in October 2026. The LINDDUN website states copyright of KU Leuven and no open licence could be verified, so this template reproduces none of its threat trees, catalogues, descriptions or method text; the prompts, register, matrices and examples are original. Consult linddun.org for the full method and its threat knowledge. This is an engineering format, not legal advice. Template licence: MIT.