What are the three new data protection goals that extend the classic CIA triad?
The three new data protection goals are Transparency (data processing is traceable), Unlinkability (data can't be repurposed), and Intervenability (data subjects can exercise their rights).
* The classic CIA triad extended with the three data-protection goals (TUI). *
The extended security model — CIA + TUI:
| Classic CIA Goals | New Data Protection Goals |
|---|---|
| Confidentiality | Transparency |
| Integrity | Unlinkability (Nichtverkettbarkeit) |
| Availability | Intervenability (Intervenierbarkeit) |
The three new goals explained:
-
Transparency — All processing of personal data must be comprehensible, verifiable, and assessable. Data subjects, operators, and supervisory authorities must be able to understand what happens with the data.
-
Unlinkability (Nichtverkettbarkeit) — Personal data cannot be used for purposes other than the one for which it was originally collected. Prevents function creep and unauthorized cross-referencing.
-
Intervenability (Intervenierbarkeit) — Systems must be designed so that data subjects can effectively exercise their rights (access, rectification, deletion, objection).
Why these additions matter: The CIA triad was designed for system security. The new goals address data protection specifically — ensuring that even when systems are technically secure, the people whose data is processed retain control and visibility.
Go deeper:
Privacy by design (Wikipedia) — the data-protection-by-design principles these goals operationalise.