Attacker can link two items of interest (e.g., data items, messages, or actions) without knowing the identity of the data subject

LINDDUN

Details
Full Name

LINDDUN Privacy Threat Modeling Framework

Also known as

LINDDUN GO, Privacy Threat Modeling, Privacy STRIDE

Core Concepts:

Linkability

Attacker can link two items of interest (e.g., data items, messages, or actions) without knowing the identity of the data subject

Identifiability

Attacker can identify a data subject from a set of data subjects through items of interest

Non-repudiation

Data subject cannot deny having performed an action or having sent a message; system logs become a liability

Detectability

Attacker can deduce the existence or absence of a data item or communication, even without access to its content

Disclosure of Information

Unauthorized exposure of data to a party without the data subject’s consent; classical confidentiality breach from a privacy perspective

Unawareness

Data subjects are not sufficiently informed about the collection, processing, storage, and sharing of their personal data; violates transparency principles

Non-compliance

System does not comply with privacy legislation, regulations, or organizational privacy policies (e.g., GDPR, CCPA, HIPAA)

Key Proponents

Kim Wuyts, Riccardo Scandariato, Wouter Joosen (KU Leuven / DistriNet Research Group, published 2014)

When to Use:

  • Conducting privacy threat modeling during the design or architecture phase

  • Performing privacy impact assessments (PIA) or data protection impact assessments (DPIA)

  • Identifying privacy risks in systems that handle personal data

  • Evaluating compliance with GDPR, CCPA, HIPAA, and other privacy regulations

  • Integrating Privacy by Design into the software development lifecycle

  • Training development teams on privacy engineering concepts

Current Status:

  • The prior likely reflects the original academic LINDDUN of the 2010s: a single heavyweight DFD-based method with the old seven categories including plain "Unawareness"

  • Current LINDDUN (KU Leuven) is a family of three flavors — GO (33-card lightweight deck, 2024 redesign), PRO (systematic), and MAESTRO (most thorough) — built on a 2024-updated threat knowledge base where the "U" became "Unawareness & Unintervenability"