LINDDUN — Privacy Threat Modelling
Scope and purpose
Security threat modelling (STRIDE) protects the system against an adversary. Privacy threat modelling protects the person whose data the system processes — a distinct problem, with threats that STRIDE does not capture. LINDDUN, developed at KU Leuven, is the reference methodology for that problem.
The manual already includes an applied example of LINDDUN. This addon provides the method behind it, so that it can be applied to any system, and not merely followed as an example.
Applicability: any system that processes personal or regulated data, at all levels (THR-003). At L1, in lightweight form: the seven categories worked through over the personal-data flows. At L2 and L3, as a formal analysis; at L3, with independent review by the DPO. Where there is an obligation to carry out a Data Protection Impact Assessment (DPIA) under the GDPR, LINDDUN is the instrument that structures its technical component.
LINDDUN structures the elicitation of privacy threats. It does not replace the legal compliance assessment or the DPO's opinion — the Non-compliance category points to legal obligations; it does not resolve them.
The seven threat categories
The acronym names seven types of privacy threat:
| Category | Threat |
|---|---|
| Linking | Relating two items of interest (data or actions) that refer to the same person, without necessarily identifying them |
| Identifying | Identifying a specific person from a set of data |
| Non-repudiation | Making it impossible for the person to deny an action or claim attributed to them |
| Detecting | Inferring the existence of an item of interest about the person, even without accessing its content |
| Data Disclosure | Exposing or improperly accessing personal data |
| Unawareness | The person is not informed about the collection, processing or sharing of their data |
| Non-compliance | The system does not comply with data protection principles and obligations |
The current nomenclature (Linking, Identifying, Detecting, Data Disclosure) replaces the earlier terms still found in older material (Linkability, Identifiability, Detectability, Disclosure of information). They are equivalent.
The Non-repudiation category is, in privacy, a threat — the opposite of its role in security, where non-repudiation is an objective. For the person, the impossibility of denying an action can be a risk (for example, exposing a political or health orientation). The inversion is deliberate and must be understood when applying the model.
The method
- Model the system in a DFD. Represent the system in a data flow diagram — external entities, processes, data stores and data flows. The DFD is the basis onto which the threats are mapped; without it, elicitation is diffuse.
- Map categories to the DFD elements. Each element type is susceptible to a subset of the seven categories. The element–category mapping is what makes the analysis systematic rather than dependent on intuition.
- Elicit concrete threats. From each (element, category) pair, derive specific threats, supported by the LINDDUN threat trees or, in a lighter approach, by the LINDDUN GO cards.
- Prioritise and mitigate. Order the threats by risk to the person and by data sensitivity (Ch. 01), and derive privacy requirements and mitigation measures — minimisation, anonymisation, consent, transparency.
- Link to legal obligations. Anchor the threats and mitigations to the applicable obligations (GDPR, DPIA), in coordination with the DPO. The Non-compliance category is the bridge to this layer.
Relation to security threat modelling
LINDDUN and STRIDE are complementary, not interchangeable. A system can be secure and, at the same time, violate privacy — collecting excessive data, retaining without a legal basis, allowing re-identification. Privacy is not a subset of security. Systems that process personal data must apply both, on the same DFD.
Cross-references
| Document | Relation |
|---|---|
| Ch. 03 — Privacy example (LINDDUN) | Concrete application of this method |
| Ch. 03 — Methodologies and tools | Security threat modelling (STRIDE), complementary |
| Ch. 01 — Application classification | Data sensitivity as the basis for prioritisation |
On curation: Consolidated from LINDDUN (KU Leuven, linddun.org), the GDPR (DPIA and minimisation obligations) and the NIST Privacy Framework. Privacy threat elicitation methodology — it complements security threat modelling and does not replace the legal compliance assessment.