DFLab is pleased to announce the commencement of public consultation on Data Privacy Vulnerabilities and Exposures (DPVE), a proposed open standard for the identification, classification, documentation and referencing of data privacy vulnerabilities and exposures.
Developed with input and consultation from privacy researcher Dr Saad Masood (Swinburne University of Technology), DPVE seeks to address a gap in how privacy-related issues are documented, identified and referenced across research, engineering and organisational environments.
The Problem
In cybersecurity, systems such as Common Vulnerabilities and Exposures (CVE) allow vulnerabilities to be assigned persistent identifiers, enabling researchers, engineers and organisations to consistently reference the same underlying issue.
However, there is no widely adopted equivalent for data privacy vulnerabilities and exposures.
Privacy issues such as excessive personal information collection, undisclosed third-party tracking, inadequate consent mechanisms, inappropriate data sharing and privacy-invasive system designs are frequently documented through academic research, regulatory investigations, organisational disclosures and independent technical assessments.
Despite this, these findings often remain fragmented across different publications, reports and databases, making it difficult to correlate findings, conduct comparative research, track remediation and integrate privacy-related information into existing technical and organisational workflows.
DPVE proposes to address this fragmentation through a common identification framework for data privacy occurrences.
What is DPVE?
DPVE proposes assigning persistent identifiers to identifiable privacy occurrences, using a format such as:
DPVE-2026-000001
Each identifier would correspond to a structured, evidence-based record documenting a particular privacy vulnerability or exposure, including relevant systems, processing activities, supporting evidence, verification and remediation information.
The proposed framework distinguishes between privacy vulnerabilities, privacy exposures and occurrences involving both.
Importantly, DPVE recognises that privacy failures do not necessarily require cybersecurity breaches or technical malfunctions. A system may operate exactly as designed while engaging in processing activities that create significant privacy risks.
DPVE is intended to complement existing privacy and cybersecurity frameworks, supporting applications in privacy engineering, academic research, privacy impact assessments, organisational risk management and regulatory processes.
It is not intended to determine legal wrongdoing or replace existing standards and regulatory mechanisms.
Opening DPVE for Public Consultation
DPVE remains an experimental proposal. Its technical foundations, governance arrangements and operational requirements are subject to further evaluation and development.
DFLab is inviting researchers, privacy and cybersecurity professionals, engineers, academics, organisations, regulators, civil-society groups and interested individuals to critically evaluate the proposed framework.
We particularly welcome feedback on:
- Whether DPVE addresses a meaningful gap in existing privacy and cybersecurity frameworks.
- How privacy vulnerabilities and exposures should be defined and identified.
- What requirements are necessary to establish credible, reproducible records.
- How DPVE should be governed to ensure transparency, accountability and long-term accessibility.
- How DPVE could integrate with existing research, engineering, regulatory and organisational workflows.
We welcome not only support for the proposal, but also constructive criticism, alternative approaches and identification of potential limitations.
Consultation Documents
To support public and technical evaluation, DFLab has published two documents:
DPVE Public Consultation Paper. Introduces the proposal, its objectives and the principal questions for consultation.
DPVE Preliminary Specification v0.1.0. Provides a more detailed examination of DPVE’s proposed terminology, identification model, record structure, evidence requirements, verification, governance and interoperability, including an illustrative DPVE record.
Both documents are published for consultation purposes and remain subject to revision.
How to Participate
Consultation opens: 26 October 2026
Consultation closes: To be announced
Submissions: [email protected]
Respondents are welcome to address any or all of the consultation questions, propose alternative approaches or provide general feedback on the initiative.
Feedback received will inform subsequent revisions of the DPVE specification, experimental validation and consideration of future governance arrangements.