What it covers. An international standard that describes a privacy architecture framework for ICT systems that process personally identifiable information. It sets out concerns, architectural views and components that help system designers build privacy safeguards into the structure of a system, and it builds on the privacy principles of ISO/IEC 29100.
In practice. Applying it well means considering privacy at architecture stage: identifying where personal data is collected, stored and transferred, and placing components such as consent handling, access control, pseudonymisation and logging accordingly. Architects document how the design supports privacy principles and data minimisation. Evidence includes architecture documents with privacy views and design decisions linked to privacy impact assessments.
Common gaps. Organisations often treat privacy as a late compliance check rather than an architecture input, and design documents seldom show where personal data flows.