arrow-left

All pages
gitbookPowered by GitBook
1 of 30

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

L3 - Development

To know more about this phase of the DPI life cycle, click here

Click on any process listed below to learn about illustrative practices that can be implemented.

Process
Principle
Risks

R1 - Government

hashtag
Typical DPI-related roles and responsibilities of 'Government' include:

  • overall governance: from policymaking to public service delivery

creating policies to set development goals
  • guiding inclusive digitalization

  • providing budgetary support for development purposes and DPI development

  • providing proof of progress to constituents

  • listening to feedback and improving legislative, executive and judicial administration

  • hashtag
    Click Next to explore the process recommendations in the Conception and Scoping stage of the DPI life cycle.

    SV4 Technical shortcomings RS2 Digital insecurity

    O8.5 Focus on cost reduction

    O8 Sustain financial viability

    SV5 Unsustainability

    F4.9 Insitutionalize oversight mechanisms
    F4 Reinforce transparency and accountability
    SV3 Weak institutions
    F4.10 Adhere to open standards and modular architecture.
    F4 Reinforce transparency and accountability

    L2 - Strategy and Design

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    L1 - Conception and Scoping

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    L4 - Deployment

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks

    SV 1 Digital distrust,

    SV4 Technical shortcomings

    F2.1 Implement alternative enrollment measures

    F2 Do not discriminate

    RI3 Exclusion

    F3.3 Assess the interoperability system

    F3 Do not exclude

    SV3 Weak institutions,

    SV4 Technical shortcomings

    F3.4 Develop alternative processes to allow access to services without requiring subscription to a DPI system

    F3 Do not exclude

    RI3 Exclusion

    RI2 Unequal access

    F3.5 Implement affirmative design measures

    F3 Do not exclude

    SV2 Weak rule of law

    RI3 Exclusio

    F4.5 Establish comprehensive auditing mechanisms

    F4 Reinforce transparency and accountability

    SV3 Weak institutions,

    F4.6 Create stakeholder participation systems

    F4 Reinforce transparency and accountability

    RI3 Exclusion

    SV 1 Digital distrust,

    F4.7 Ensure an auditable data trail for dispute redressal

    F4 Reinforce transparency and accountability

    RS2 Digital insecurity

    RS4 Lack of recourse

    F4.8 Provide clear definitions for key human rights terms so basic understanding of harms is inter-operable and can be benchmarked across systems.

    F4 Reinforce transparency and accountability

    RI4 Disempowerment

    RI2 Unequal access

    F6.3 Incorporate user choice mechanisms to participate

    F6 Promote autonomy and agency

    RI4 Disempowerment

    SV4 Technical shortcomings

    F6.4 Design user interfaces that empower data subjects with clear and continuous control over their data.

    F6 Promote autonomy and agency

    RI4 Disempowerment

    F7.3 Forward relevant stakeholder inputs to the DPI implementors.

    F7 Foster community engagement

    SV3 Weak institutions

    RI4 Disempowerment

    F7.4 Sustain the participation of affected communities in the process by providing funding for the total cost of community engagment

    F7 Foster community engagement

    RI2 Unequal access RI3 Exclusion

    F8.3 Ensure that the DPI interface indicates the responsible public authority and their contact information for complaints and inquiries.

    F8 Ensure effective remedy and redress

    SV1 Digital distrust

    F9.4 Adopt common standards, conduct regular system integration tests, and ensure that redundant system operations are removed

    F9 Focus on future sustainability

    SV5 Unsustainability

    SV3 Weak institutions

    F9.5 Conduct stringent security checks and vendor assessments

    F9 Focus on future sustainability

    SV3 Weak institutions SV5 Unsustainability

    F9.6 Encourage modular system design and support for multiple technologies.

    F9 Focus on future sustainability

    SV3 Weak institutions SV5 Unsustainability

    F9.7 Adopt comprehensive procurement processes that prevent vendor lock in

    F9 Focus on future sustainability

    SV4 Technical shortcomingsSV2 Weak rule of law

    O1.4 Provide tools and support to enable integration and scalability

    O1 Leverage market dynamics

    SV5 Unsustainability

    O1.5 Develop an open access system with APIs, accountability, and fraud protections

    O1 Leverage market dynamics

    RI3 ExclusionRS2 Digital insecurity

    O2.2 Implement regular public consultations and review mechanisms.

    O2 Evolve with evidence

    RI3 Exclusion RI4 Disempowerment

    O2.3 Design mechanisms to generate relevant data

    O2 Evolve with evidence

    SV3 Weak institutions SV4 Technical shortcomings

    O2.4 Design feedback loops to address data inaccuracies and enable community reporting

    O2 Evolve with evidence

    RS2 Digital insecuritySV4 Technical shortcomingsSV 1 Digital distrust

    O3.5 Integrate strict data minimization protocols into design

    O3 Ensure data privacy by design

    SV 1 Digital distrust

    RS1 Privacy Vulnerability

    O3.6 Establish multi-layered security controls to protect data throughout its lifecycle

    O3 Ensure data privacy by design

    RS1 Privacy Vulnerability SV4 Technical shortcomingsRI4 Disempowerment

    O3.7 Undertake a Data Protection Impact assessments and legislative reforms prior to DPI roll out

    O3 Ensure data privacy by design

    RS1 Privacy Vulnerability SV2 Weak rule of law

    O3.8 Enable third party audits

    O3 Ensure data privacy by design

    RS1 Privacy Vulnerability

    O3.9 Establish Robust Data Delinking Mechanisms once the purpose of the processing of personal information has been served

    O3 Ensure data privacy by design

    RS1 Privacy Vulnerability RS2 Digital insecurity

    O3.10 Enable different levels of privacy between payer and payee, where appropriate.

    O3 Ensure data privacy by design

    RS2 Digital insecurityRS1 Privacy Vulnerability

    O3.11 Implement symmetrical identification so users know the identity of the other party in a transaction.

    O3 Ensure data privacy by design

    SV1 Digital distrust

    O3.12 Implement and protect the right to pseudonymity within DPI systems, when applicable.

    O3 Ensure data privacy by design

    SV1 Digital distrust

    O3.13 Ensure that biometric authentication is not mandatory

    O3 Ensure data privacy by design

    RS1 Privacy Vulnerability SV4 Technical shortcomingsRI3 Exclusion

    O4.8 Design specific security features to protect against unauthorized access and data breaches

    O4 Assure data security by design

    RS1 Privacy Vulnerability

    F3.3 Identify and address end user/citizen needs
    F3 Do not exclude
    RI3 Exclusion
    F1.3 Establish monitoring and mitigation teams
    F1 Do no harm

    RS1 Privacy vulnerability

    RS4 Lack of recourse

    F5.2 Underpin identification systems (and other DPI systems) by legitimate, comprehensive, and enforceable legal and regulatory frameworks

    F5 Uphold the rule of law

    SV1 Digital distrust

    SV3 Weak institutions

    F6.2 Design and deploy mechanisms that provide individuals and communities with control over their personal and collective data

    F6 Promote autonomy and agency

    RI4 Disempowerment

    SV1 Digital distrust

    F7.1 Forward relevant stakeholder inputs to the DPI implementors.

    F7 Foster community engagement

    SV3 Weak institutions

    RI4 Disempowerment

    F9.2 Ensure adequate resourcing for continuous development.

    F9 Focus on future sustainability

    SV5 Unsustainability

    O1.2 Establish policies that promote fair competition and require multiple participants in the ecosystem

    O1 Leverage market dynamics

    SV5 Unsustainability

    O1.3 Mitigate the risk of market distortion and monopolies

    O1 Leverage market dynamics

    SV3 Weak institutions

    O2.1 Assess DPI against alternative policy options

    O2 Evolve with evidence

    SV5 Unsustainability

    RI1 Discrimination

    O3.1 Verify the existence and enforcement of regulations, policies and procedures that mandate purpose limitation.

    O3 Ensure data privacy by design

    RS1 Privacy vulnerability

    SV2 Weak rule of law

    O3.2 Undertake a Data Protection Impact assessments and legislative reforms prior to DPI roll out

    O3 Ensure data privacy by design

    RS1 Privacy vulnerability

    SV2 Weak rule of law

    O3.3 Analyze stakeholder interests and implement approprate safeguards

    O3 Ensure data privacy by design

    RS1 Privacy vulnerability

    SV2 Weak rule of law

    O3.4 Provide features to protect users from tracking and profiling while allowing responsible data use

    O3 Ensure data privacy by design

    SV1 Digital distrust

    RI4 Disempowerment

    O4.1 Establish a framework for safe data storage and processing

    O4 Assure data security by design

    RS2 Digital insecurity

    O4.2 Establish a cybersecurity framework for DPI

    O4 Assure data security by design

    RS2 Digital insecurity

    O5.1 Implement privacy and data protection impact assessments prior roll-out

    O5 Ensure data protection during use

    SV2 Weak rule of law

    RS1 Privacy vulnerability

    O5.2 Require relying parties to register their DPI use cases in a public registry, detailing the specific functionalities and data attributes they intend to use.

    O5 Ensure data protection during use

    SV1 Digital distrust

    O6.2 Understand the needs of affected communities and test the impact of DPI on these groups.

    O6 Respond to gender, ability or age

    RI4 Disempowerment

    RI3 Exclusion

    O6.3 Ensure equitable access to DPI

    O6 Respond to gender, ability or age

    RI2 Unequal access

    RI3 Exclusion

    O6.4 Include networks of human agents to help users utilize and engage with DPI systems

    O6 Respond to gender, ability or age

    RI2 Unequal access

    RI3 Exclusion

    O8.1 Estimate the costs of deployment, operational costs, and estimate payback period

    O8 Sustain financial viability

    SV5 Unsustainability

    O8.2 Design the sustainable financing model for the DPI

    O8 Sustain financial viability

    SV5 Unsustainability

    F3.2 Implement affirmative design measures
    F3 Do not exclude
    SV2 Weak rule of law
    F5.1 Establish transparency and full documentation for data sharing arrangements
    F5 Uphold the rule of law

    R12 Unequal access,

    RI1 Discrimination,

    RS3 Physical insecurity

    F2.3 Establish mechanisms to promote ongoing user awareness and engagement

    F2 Do not discriminate

    SV1 Digital distrust,

    RI4 Disempowerment

    F9.8 Build institutional memory

    F9 Focus on future sustainability

    SV5 Unsustainability,

    SV3 Weak institution

    F9.9 Document and maintain an archive on the outcomes of pilot studies, testing, and decision-making

    F9 Focus on future sustainability

    SV3 Weak institutions

    F1 .4 Establish monitoring and mitigation teams
    F1 Do no harm
    SV1 Digital distrust,
    SV4 Technical shortcomings
    F2.2 Provide accessible in-person options for identity proofing and authentication
    F2 Do not discriminate

    All stages

    Process
    Principle
    Risk

    L5 - Operations and Maintenance

    To know more about this phase of the DPI lifecycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks

    ,

    L1 - Conception and Scoping

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks avoided

    ,

    All stages

    Process
    Principle
    Risk

    R3 - Donor

    hashtag
    Typical DPI-related roles and responsibilities of 'Donors' include:

    • providing funding and financial support

    seeking proof of progress to meet development outcomes

    hashtag
    Click Next to explore the process recommendations in the Conception and Scoping stage of the DPI Lifecycle.

    SV3 Weak institutions

    O6.8 Use a participatory approach to foster inclusive, responsive, and empowering DPI for marginalized communities.
    O6 Respond to gender, ability or age
    R1.4 Disempowerment,
    R1.3 Exclusion
    O7.2 Invite all stakeholders for regular discussions
    O7 Practice inclusive governance
    R1.3 Exclusion
    RI2 Unequal access
    F7.8 Implement a capacity-building strategy using a Whole-of-Government approach to ensure all relevant functional groups can effectively support safeguards.
    F7 Foster community engagement

    SV2 Weak rule of law

    O3.29 Audit data processed against the specified purpose that is being served

    O3 Ensure data privacy by design

    RS2 Digital insecurity, RS1 Privacy vulnerability

    O3.21 Establish mechanisms to ensure a right to opt-out whenever appropriate

    O3 Ensure data privacy by design

    RI4 Disempowerment, SV2 Weak rule of law

    O3.3 Analyze stakeholder interests and implement approprate safeguards

    O3 Ensure data privacy by design

    RS1 Privacy vulnerability

    O3.5 Enable third-party audits

    O3 Ensure data privacy by design

    RS1 Privacy vulnerability

    O4.9 Mandate security audits by third parties

    O4 Assure data security by design

    RS2 Digital insecurity, SV1 Digital distrust

    F4.14 Oversee the publication of reports on user complaints and inclusion metrics.
    F4 Reinforce transparency and accountability
    RS4 Lack of recourse
    SV3 Weak institutions
    F9.10 Set a normative framework for public-private partnership to implement DPI frameworks
    F9 Focus on future sustainability

    RS1 Privacy vulnerability, SV2 Weak rule of law

    F5.5 Implement independent oversight and impartial grievance adjudication.

    F5 Uphold the rule of law

    SV1 Digital distrust, RI4 Disempowerment

    O2.5 Assess DPI against alternative policy optionsarrow-up-right

    O2 Evolve with evidence

    SV5 Unsustainability, RI1Discrimination

    O3.7 Undertake a Data Protection Impact assessments and legislative reforms prior to DPI roll out

    O3 Ensure data privacy by design

    RS1 Privacy vulnerability, SV2 Weak rule of law

    O3.21 Establish mechanisms to ensure a right to opt-out whenever appropriate

    O3 Ensure data privacy by design

    RI4 Disempowerment, SV2 Weak rule of law

    O5.7 Oversee the implementation of privacy and data protection impact assessments prior roll-out.

    O5 Ensure data protection during use

    SV3 Weak institutions, RS1 Privacy vulnerability

    O5.9 Assess existence of comprehensive data protection laws that outline the lawful processing, retention, and protection of personal data

    O5 Ensure data protection during use

    SV2 Weak rule of law, RS1 Privacy vulnerability

    F1.2 Incorporate legal safeguards against coercive measures of enforcement
    F1 Do no harm
    SV2 Weak rule of law
    RI4 Disempowerment
    F5.4 Establish appropriate legal framework to govern DPI initiatives, ensuring clarity on scope, purpose, and limitations.
    F5 Uphold the rule of law

    F8.7 Ensure that there are independent, accessible and effective remedies and related mechanisms available for persons whose rights are violated by the system
    F8 Ensure effective remedy and redress
    SV3 Weak institutions,
    SV2 Weak rule of law

    L1 Conception and Scoping

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk Mitigated

    ,

    L2 - Strategy and Design

    To know more about this phase of the DPI life cycle, click here.

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    L5 Operations and Maintenance

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks Avoided

    L5 - Operations and Maintenance

    To know more about this phase of the DPI life cycle, click here.

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    L1 - Conception and Scoping

    To know more about this phase of the DPI life cycle, click here.

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    L4 Deployment

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks Avoided

    L1 - Conception and Scoping Phase

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    L3 - Development

    To know more about this phase of the DPI life cycle - Click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks avoided

    R4 - Technology Provider

    hashtag
    Typical DPI-related roles and responsibilities of 'Technology Providers' include:

    • providing a focal point for technical work, risk identification and mitigation strategies

    • having influence over and advising on actual implementation through to maintenance and support of DPI

    hashtag
    Click Next to explore the process recommendations in the

    All stages

    Process
    Principle
    Risk

    L3 - Development

    To know more about this phase of the DPI life cycle, click here.

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    ,

    R5 - Advocates

    hashtag
    Typical DPI-related roles and responsibilities of 'Advocates' include:

    • driving advocacy for DPI safeguards

    • working to uphold human rights

    • representing the interests of the marginalized and diverse sections of the society

    • providing innovative ideas to make DPI more inclusive

    • highlighting incongruence with existing laws and regulations


    hashtag
    Click Next to explore Safeguards Processes in the stage of the DPI Lifecycle.

    L4 - Deployment

    To know more about this phase of the DPI life cycle - Click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks avoided

    L5 - Operations and Maintenance

    To know more about this phase of the DPI life cycle - Click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks avoided

    L2 - Strategy and Design

    To know more about this phase of the DPI life cycle - Click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risks avoided

    L2 Strategy and Design

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principles
    Risks Avoided

    ,

    L5 - Operations and Maintenance

    To know more about this phase of the DPI life cycle, click here

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    L2 - Strategy and Design

    To know more about this phase of the DPI life cycle, click

    Click on any process listed below to learn about illustrative practices that can be implemented.

    Process
    Principle
    Risk

    Responsible Authorities

    A functional group of stakeholders with assigned or assumed roles, responsibilities, and accountability for effective implementation and evolution of DPI safeguards.

    circle-info

    Navigate the Framework: The Framework can be explored by starting with the selection of a . Each Responsible Authority has a specific role to play at every of the DPI. You can explore what actions each Authority must take to advance the Universal DPI Safeguards , through processes and practices so as to avoid/mitigate certain identified risks.

    R2 - Regulator

    hashtag
    Typical DPI-related roles and responsibilities of 'Regulators' include:

    • setting appropriate and effective guardrails

    supervising and enforcing laws and regulations

    hashtag

    hashtag
    Click Next to explore the process recommendations in the Conception and Scoping stage of the DPI Lifecycle.

    Conception and Scoping stage of the DPI Lifecycle.
    Conception and Scoping

    SV3 Weak institutions, SV5 Unsustainability

    O8.3 Design the sustainable financing model for the DPI

    O8 Sustain financial viability

    SV5 Unsustainability

    F4.2 Facilitate comprehensive access to system architecture informationarrow-up-right
    F4 Reinforce transparency and accountability
    SV1 Digital distrust
    RI4 Disempowerment
    F9.3 Prioritize investments in reusable software components to create standardized workflows that can be applied across multiple sectors.
    F9 Focus on future sustainability

    SV1 Digital Distrust, SV4 Technical shortcomings

    F6.5 Implement optional features for user control over personal data

    F6: Promote autonomy and agency

    RI4 Disempowerment, RS1 Privacy vulnerability

    O2.5 Implement rigorous testing protocols

    O2: Evolve with evidence

    SV3 Weak institutions

    O3.14 Integrate strict data minimization protocols into design

    O3: Ensure data privacy by design

    RS1 Privacy vulnerability

    O3.15 Implement strict controls to enforce purpose limitation and restrict secondary data use.

    O3: Ensure data privacy by design

    RS1 Privacy vulnerability, SV1 Digital distrust

    O3.16 Embed strong standards of privacy from the start and integrate it into design and processes

    O3: Ensure data privacy by design

    O3.17 Ensure compliance with privacy laws and evaluate risks related to PII by conducting and publicly documenting privacy impact assessments for new or updated technologies and systems.

    O3: Ensure data privacy by design

    O3.18 Emphasize transparency and user empowerment in managing data.

    O3: Ensure data privacy by design

    RI4 Disempowerment, RS1 Privacy vulnerabilities

    O3.19 Develop privacy requirements and select mitigation strategies, documenting and iterating your analysis as needed.

    O3: Ensure data privacy by design

    O.20 Ensure unobservability of Daily User Interactions by Design

    O3: Ensure data privacy by design

    RS1 Privacy vulnerability

    O.21 Establish mechanisms to ensure a right to opt-out whenever appropriate

    O3: Ensure data privacy by design

    RI4 Disempowerment, RS1 Privacy vulnerability

    O3.22 Ensure linkability, unobservability, and zero-knowledge proofs are the default

    O3: Ensure data privacy by design

    RS1 Privacy vulnerability, RS2 Digital insecurity

    O3.23 Establish Robust Data Delinking Mechanisms once the purpose of the processing of personal information has been served

    O3: Ensure data privacy by design

    RS1 Privacy vulnerability

    O3.24 Make alternative mechanisms besides biometrics available for enrollment for special cases (leave nobody behind)

    O3: Ensure data privacy by design

    O3.25 Ensure that biometric authentication is not mandatory

    O3: Ensure data privacy by design

    RI3 Exclusion, RS1 Privacy vulnerability, SV4 Technical shortcomings

    O4.3 Ensure secure and auditable data handling

    O4: Assure data security by design

    RS2 Digital insecurity, RS1 Privacy vulnerability, SV4 Technical shortcomings

    O6.6 Embed vulnerability in product design

    O6: Respond to gender, ability or age

    RI4 Disempowerment

    F2.4 Design and implement backup processes for users who lack assumed documentation
    F2: Do not discriminate
    R13 Exclusion,
    RI1 Discrimination
    F4.10 Implement comprehensive reporting and accessibility protocols
    F4: Reinforce transparency and accountability
    F4.4 Facilitate comprehensive access to system architecture informationarrow-up-right
    F4 Reinforce transparency and accountability
    SV1 Digital distrust,
    RI4 Disempowerment

    F4.10 Implement comprehensive reporting and accessibility protocols

    F4: Reinforce transparency and accountability

    SV1 Digital distrust

    SV4. Technical shortcomings

    F6.5 Implement optional features for user control over personal data

    F6: Promote autonomy and agency

    RI4 Disempowerment,

    S1 Privacy vulnerability

    F9.13 Implement public-private partnership frameworks for sustainable DPI implementation

    F9: Focus on future sustainability

    SV3 Weak institutions

    O4.7 Implement a framework for safe data storage and processing

    O4: Assure data security by design

    RS2. Digital insecurity

    S1 Privacy vulnerabilitySV4. Technical shortcomings

    O4.5 Implement data validation, completeness, and consistency checks

    O4: Assure data security by design

    RS2. Digital insecurity

    O5.4 Conduct regular security audits to check encryption protocols

    O5: Ensure data protection during use

    RS2. Digital insecurity

    S1 Privacy vulnerability

    O5.5 Implement regular performance metrics tracking with predefined response protocols

    O5: Ensure data protection during use

    SV3 Weak institutions

    RS2. Digital insecurity

    SV4. Technical shortcomings

    F1.5 Assess system uptime to ensure reliability.
    F1: Do no harm
    SV1 Digital distrust
    O3.26 Implement strict controls to enforce purpose limitation and restrict secondary data use
    O3 Ensure data privacy by design
    RS1 Privacy vulnerability,
    SV1 Digital distrust
    O6.5 Acknowledge and support the development of digital foundational capacities, including digital literacy and digital safety, to ensure equitable access and effective use of DPI.arrow-up-right
    O6 Respond to gender, ability or age
    RI3 Exclusion, RI4 Disempowerment

    RS2 Digital insecurity

    SV1 Digital distrust

    F1.1 Facilitate accessible remedial mechanisms
    F1 Do no harm
    RS4 - Lack of recourse
    RI2 - Unequal access
    F4.1 Ensure that there is access to information about every relevant architecture aspect of the system
    F4 Reinforce transparency and accountability

    RI3 Exclusion, RI2 - Unequal access

    F8.1 Conduct environmental impact assessments and demand the adoption of measures which accelerate progress towards carbon neutrality.

    F8 Focus on future sustainability

    SV5 Unsustainability

    F1.1 Facilitate accessible remedial mechanisms
    F1 Do no harm
    RS4 - Lack of Recourse
    RI2 - Unequal access
    F9.1 Establish a collaborative governance framework with public and private stakeholders
    F9 Are not exclusive

    F5.3 Highlight instances of discrimination and failure
    F5 Uphold the rule of law
    SV2. Weak rule of law
    RI3. Exclusion
    RI1. Discrimination
    O3.27 Increase public awareness about risks in DPI
    O3 Ensure data privacy by design
    SV1 Digital distrust

    RI4 Disempowerment, RS1 Privacy vulnerability

    O2.5 Implement rigorous testing protocols

    O2: Evolve with evidence

    SV4 Technical Shortcomings

    O3.21 Establish mechanisms to ensure a right to opt-out whenever appropriate

    O3: Ensure data privacy by design

    RI4 Disempowerment, RS1 Privacy vulnerability

    O3.4 Provide features to protect users against tracking and profiling

    O3: Ensure data privacy by design

    SV1 Digital distrust, RI4 Disempowerment

    O4.4 Establish a trusted—unique, secure, and accurate—identity. Make more specific to this process

    O4: Assure data security by design

    SV1 Digital distrust, RI4 Disempowerment

    O4.5 Implement data validation, completeness, and consistency checks

    O4: Assure data security by design

    RS2 Digital insecurity

    O4.6 Use an established cybersecurity framework

    O4: Assure data security by design

    RS2 Digital insecurity

    O5.3 Ensure digital presevation of records

    O5: Ensure data protection during use

    SV4 Technical shortcomings, RS2 Digital insecurity

    O6.7 Ensure that DPI are linguistically appropriate for the whole population

    O6: Respond to gender, ability or age

    RI3 Exclusion, SV4 Technical shortcoming

    O9.1 Ensure modularity and reusability across sectors, enabling evolution with society by unbundling DPI into core components (e.g., digital identity, payments, data sharing)

    O9: Build and share open assets

    SV4 Technical shortcomings

    F4.12 Ensure accountability through records controls
    F4: Reinforce transparency and accountability
    SV4 Technical shortcomings
    RS4 Lack of recourse
    F6.5 Implement optional features for user control over personal data
    F6: Promote autonomy and agency

    SV.1 Digital distrust , RI3. - Exclusion

    O6.1 Raise awareness if the DPI guidance is not linguistically appropriate for the whole population

    O6 Respond to gender, ability or age

    RI2 - Unequal access , RI3 - Exclusion

    F3.1 Provide accessible in-person options for identity proofing and authentication
    F3 Do not discriminate
    RI2 - Unequal access , RI3 - Exclusion
    O1.1 Equip CSOs and civic tech organizations with tools and partnerships
    O1 Leverage market dynamics

    RI4 - Disempowerment , SV1 - Digital distrust

    F8.1 Facilitate user access to redress mechanisms
    F8 Ensure effective remedy and redress
    RS4 - Lack of recourse
    F8.2 Ensure that there are independent, accessible and effective remedies and related mechanisms available for persons whose rights are violated by the system
    F8 Ensure effective remedy and redress

    RI4 Disempowerment

    SV1 Digital distrust

    F4.1 Ensure that there is access to information about every relevant architecture aspect of the system
    F4 Reinforce transparency and accountability
    RS2 Digital insecurity
    SV1 Digital distrust
    F6.1 Evaluate the level of granular control available to users over their data preferences
    F6 Promote autonomy and agency

    SV1 Digital distrust, R13 Exclusion

    F8.4 Implement multi-channel complaint resolution mechanism that tracks resolution

    F8 Ensure effective remedy and redress

    RS4. Lack of recourse

    F8.5 Establish capability to succesfully remedy user exclusion & harm

    F8 Ensure effective remedy and redress

    RS4. Lack of recourse

    RI4 Disempowerment

    F8.6 Empower regulators with independent oversight

    F8 Ensure effective remedy and redress

    SV2 Weak rule of law

    F9.12 Train civil servants, citizens and the private sector on new iterations of DPI implementation

    F9 Focus on future sustainability

    SV3 Weak institutionsSV5 Unsustainability

    O2.7 Design systems to capture evolving user needs

    O2 Evolve with evidence

    R13 Exclusion

    SV1 Digital distrust,

    O2.8 Leverage analytics for ongoing evaluation and informed decision-making.

    O2 Evolve with evidence

    SV3 Weak institutions

    O2.9 Establish mechanisms to assess the value users derivearrow-up-right

    O2 Evolve with evidence

    R13 Exclusion

    SV1 Digital distrust,

    O4.7 Invite security audits by third parties

    O4 Assure data security by design

    RS2 Digital insecurity,

    SV4 Technical shortcomings

    O5.6 Implement regular performance metrics tracking with predefined response protocols

    O5 Ensure data protection during use

    SV3 Weak institutions

    RS2 Digital insecurity,

    SV4 Technical shortcomings

    O5.5 Ensure that access to personal information is based on the informed consent of the user that is freely given and can be withdrawn

    O5 Ensure data protection during use

    RS1 Privacy vulnerability,

    RS4 Lack of recourse

    O5.8 Create redress mechanisms that allow for bad actors (fraud, identity theft, data protection violations, etc) to be expelled.

    O5 Ensure data protection during use

    RS2. Digital insecurity

    O5.3 Ensure digital preservation of records

    O5 Ensure data protection during use

    SV4 Technical shortcomings

    O7.1 Establish governance frameworks that ensure transparency, accountability, and stakeholder participation

    O7 Practice inclusive governance

    SV3 Weak institutionsRI4 Disempowerment

    O8.6 Ensure budgetary allocation for DPI financial sustainability and adequate resourcing for continuous development.

    O8 Sustain financial viability

    SV5 Unsustainability

    O9.2 Develop a centralized platform for digital asset sharing and foster a community of practice for knowledge exchange

    O9 Build and share open assets

    SV4 Technical shortcomings

    O9.3 Nurture engagement with technical community and private actors

    O9 Build and share open assets

    SV4 Technical shortcomings

    O9.4 Create an online repository of Open DPI components, reference architecture for maintenenace, review, improvement and engagement with technical community and private actors

    O9 Build and share open assets

    SV4 Technical shortcomings

    F1.4 Establish monitoring and mitigation teams
    F1 Do no harm
    SV1 Digital distrust,
    SV4 Technical shortcomings
    F4.11 Publish reports on inclusion and user complaints.
    F4 Reinforce transparency and accountability

    ,

    ,

    ,

    F2.5 Recognise access to DPI-based public services as a human right

    F2 Do not discriminate

    RI3 Exclusion

    F4.13 Establish requirements for auditable data trails to support dispute redressal

    F4 Reinforce transparency and accountability

    here

    hashtag
    Click on a Responsible Authority below to learn more about actionable processes and practices.

    Responsible Authority (R1-R5)
    life cycle stage (L1-L5)
    Principles (F1-F9, O1-O9)

    RI3 Exclusion, RI2 Unequal access

    O8.4 Ensure that the price of using DPI is affordable to people and businessesarrow-up-right

    O8 Sustain financial viability

    RI3 Exclusion, RI2 Unequal access

    F4.3 Facilitate comprehensive access to system architecture informationarrow-up-right
    F4 Reinforce transparency and accountability
    SV1 Digital distrust
    RI4 Disempowerment
    F7 Foster community engagement
    SV3 Weak institutions,
    RS4 Lack of recourse
    F7.5 Implement a whisteblower channel, allowing the public to address potential complaints
    F7 Foster community engagement
    RI2 Unequal access
    RS4 Lack of recourse
    F8.8 Set redress mechanisms and other consumer protection tools for failed/fraudulent financial transactions
    F8 Ensure effective remedy and redress
    RS4 Lack of recourse
    SV3 Weak rule of law
    O1.6 Enable transparency in the development of standards by standard-setting bodies
    O1 Leverage market dynamics
    RI3 Exclusion
    O3.28 Undertake a Data Protection Impact assessments and legislative reforms prior to DPI roll out
    O3 Ensure data privacy by design
    RS1 Privacy vulnerability
    SV2 Weak rule of law
    O3.21 Establish mechanisms to ensure a right to opt-out whenever appropriate
    O3 Ensure data privacy by design
    RI4 Disempowerment,
    SV2 Weak rule of law
    O5.7 Oversee the implementation of privacy and data protection impact assessments prior roll-out
    O5 Ensure data protection during use
    RS1 Privacy vulnerability,
    SV2 Weak rule of law
    O8.7 Ensure that the price of using DPI is affordable to people and businesses
    08 Sustain financial viability
    RI2 Unequal access, RI3 Exclusion

    They care about the balance between an individual's right to security and privacy and what this means for government control over ICT data.

    :

    Leads the technical implementation of the national ICT strategy.

    Provides tech infrastructure and tech implementation support.

    Provide accessible and secure DPI for citizens of their country and guides the government and private sector.

    Funds the DPI.

    Advocates:
    Government
    Technology Provider:
    Regulators:
    Donor:
    F7.2 Sustain the participation of affected communities in the process by providing funding for the total cost of community engagmentarrow-up-right