As privacy and data are subsumed within wider risk frameworks, greater self-regulation and more in-house data risk management will lead to deeper integration of engineering, privacy and policy.