Privacy enhancing technologies (PETs) have emerged as crucial solutions for protecting personal and sensitive information in a landscape characterized by extensive data breaches, surveillance concerns, and rapidly evolving data protection regulations. As enterprises continue to collect massive amounts of data, the need to secure digital systems has never been greater.
PETs are essential to this endeavor. In addition to enhancing privacy, they can increase the robustness of IT audits. However, obstacles may arise during their implementation. There is much to be gained by examining how PETs can be practically and safely applied to improve privacy and assurance outcomes—and why they should.
Types of PETs
PETs provide a set of technical measures that limit the use of personal data while still enabling valuable data-driven insights, assisting enterprises in striking a balance between innovation and privacy compliance.1 They can be divided into numerous categories, each addressing a particular aspect of data privacy.
Anonymization and Pseudonymization Tools
These tools exclude or conceal personally identifiable information (PII) from databases. A study by Seni.ar, et al., offers a conceptual model that proposes using an identity defender that replaces a user's identity with many pseudonymous IDs, lowering the possibility of profiling or spying.2 This is illustrated in figure 1.
Source: Seniar, V.; Jerman-Bla.i, B.; et al.; “Privacy-Enhancing Technologies—Approaches and Development,” Computer Standards & Interfaces, vol. 25, iss. 2, 2003, p. 147–158
Furthermore, anonymizing services such as proxies and pseudonymous servers allow users to mask their IP addresses and delete identifying metadata when using the internet.
Encryption and Steganography
Encryption secures the contents of communications and files. Suppose a manager needs to send an employee's salary information to the human resources (HR) department. The message "John's salary is R25 000" is encrypted before it is sent. It is converted into an unintelligible format, such as "x7B#8@dL%9p!*&."
If an unauthorized entity intercepted the communication during transmission, they would be unable to understand its contents. Only once the encrypted message reaches the HR department is it decoded using a secure cryptographic key, allowing the authorized receiver to see the original content.
The PET landscape continually changes as new methods of improving data protection are explored.This method maintains the confidentiality and integrity of sensitive data, demonstrating how cryptographic/encryption technologies are critical in protecting organizational information from unauthorized access or data breaches. When applied simultaneously with other PETs, they help ensure ultimate data security.
Notably, encryption does not conceal the act of communication itself. To overcome this issue, techniques such as steganography,3 which hides a message inside conventional files, add an extra layer of secrecy that prevents the detection of sensitive data sharing.
Cryptography
PETs are critical in industries such as banking, as they provide safe identification and antimoney laundering (AML) regulations. Cryptographic technologies are increasingly being used to validate identities without revealing sensitive information.4
Secret Sharing
Another prominent PET used is secret sharing, which involves dividing sensitive material into sections (shares) and transferring them to various parties. No single entity owns the entire dataset, and only a specific combination of shares can recreate the original information.5 This method improves security by ensuring that data is not kept or processed in a single, vulnerable location.
It is crucial to note that these technologies are not the only PETs in use; they constitute a sample of regularly used tools and methodologies. The PET landscape continually changes as new methods of improving data protection are explored.
Key Principles of PETs
PETs are intended to secure personal data and facilitate compliance with data protection rules by incorporating privacy into information systems. These technologies are guided by seven core principles:6
- Limiting personal data collection guarantees that only necessary information is acquired, lowering exposure and risk.
- Controlling access through strong identification, authentication, and authorization processes guarantees that only authorized personnel or systems can interact with sensitive information.
- Standard privacy protection techniques such as anonymization help erase PII, making it more difficult to track data back to specific individuals.
- Pseudoidentities allow anonymous linkability across systems or sessions without revealing genuineidentities.
- Encryption protects data at rest and in transit, making it unreadable to unauthorized parties.
- Biometrics provide a unique and powerful identification method, however, they must be treated with caution to avoid abuse.
- Auditability ensures that data-related actions can be traced and examined, which promotes accountability and allows for compliance checks.
Combining these principles enables PETs to prevent unauthorized access and ensure data minimization and protection.
The Role of PETs in Today’s Digital Landscape
In an era dominated by digital technologies, the significance of PETs has grown tremendously due to the rising risk associated with data vulnerabilities, digital surveillance practices, and the exploitation of personal information for profit. Their relevance extends across various sectors, encompassing regulatory, societal, financial, and technical considerations.
Rising Data Collection and Surveillance
The expansion of digital services has resulted in unparalleled data accumulation.7 From smartphones and social media to smart home gadgets and biometric systems, massive amounts of personal information are constantly collected. Governments and enterprises use surveillance techniques that have the potential to infringe on privacy.8 PETs such as homomorphic encryption, zero-knowledge proofs (ZKPs), and anonymization techniques allow for secure data utilization without revealing individual identities.9
Trust and Ethical Data Usage
Public trust is critical for digital platforms, particularly in sectors that deal with sensitive data (e.g., financial services, healthcare, education).10 PETs such as differential privacy enable data analysis while protecting individual-level information, allowing enterprises to preserve trust while gaining insights from data.11
Enabling Innovation Without Compromising Privacy
Innovation frequently clashes with privacy in areas such as AI and big data analytics. PETs allow data scientists to train models and conduct analytics while maintaining user confidentiality. For example, federated learning allows machine learning (ML) models to be trained locally on devices without sending personal information to central servers.12
Data Security and Risk Reduction
PETs lower cybercriminals' attack surface by limiting raw data exposure. Technologies such as secure multiparty computation (SMPC) and federated learning enable several parties to collaborate on computing results without exchanging raw datasets, considerably lowering the risk of data breaches.13
Protecting Vulnerable Populations
PETs are essential for safeguarding vulnerable populations such as journalists, activists, whistleblowers, minority groups, and citizens under authoritarian regimes who are disproportionately exposed to digital surveillance, censorship, and targeted cyberthreats. These individuals often face risk to their safety and freedom due to state and nonstate actors using personal data, geolocation tracking, and online profiling.14 Tools such as end-to-end encrypted messaging (e.g., Signal), anonymizing networks (e.g., Tor), and secure email services (e.g., Proton Mail) are widely used to protect communications and identities.15 These technologies help ensure freedom of expression and association by enabling secure communication and resistance to mass surveillance, which is especially critical in regions where civil liberties are restricted. Furthermore, deploying PETs in humanitarian contexts, such as protecting refugee data in conflict zones, has become a growing focus among nongovernmental organizations (NGOs) and international organizations.16
Common Challenges in Implementing and Auditing PETs
Despite their benefits, implementing and auditing PETs poses numerous challenges, hindering their effectiveness and adoption in real-world settings.
Technical and Integration Barriers
An organization’s size is a significant determinant in the adoption of information technologies within the auditing domain. Larger enterprises, characterized by more advanced and mature IT infrastructures, are more likely to implement PETs as a strategic measure to mitigate operational risk and minimize potential financial disruptions associated with technological integration. Furthermore, due to their enhanced resource capacity and organizational agility, large enterprises demonstrate a higher propensity to adopt technologies such as cloud computing despite inherent concerns surrounding data security, privacy, and long-term service reliability (e.g., data segregation, sustainability of cloud service providers).17
Additionally, these technologies are challenging to integrate into existing IT infrastructures. For example, many PETs are not designed with interoperability in mind, complicating their use in large-scale systems, especially those reliant on legacy architectures.18
Lack of Industry Benchmarking
Enterprises often encounter significant challenges in evaluating PETs due to the absence of standardized benchmarks. This lack of clarity leads to an opaque selection process, where decisions may be based more on assumptions or vendor claims than measurable evidence. As a result, enterprises may adopt technologies that are either ill-suited to their specific needs or fail to deliver the expected level of privacy protection. Therefore, establishing clear, standardized evaluation frameworks is essential to support more transparent and effective PET adoption.19
Auditing and Transparency Challenges
PETs inherently obscure data to maintain privacy, complicating the ability to audit them effectively. Traditional auditing mechanisms rely on visibility into data processes, which PETs intentionally limit. As a result, developing privacy-preserving audit mechanisms is both a technical and policy challenge.20 The policy challenge arises from the need to balance transparency and accountability with strict regulatory requirements for data protection and user privacy.
Regulatory and Legal Ambiguities
The implementation of PETs often lacks a clear regulatory framework, making compliance with laws such as the EU General Data Protection Regulation (GDPR) or the US Health Insurance Portability and Accountability Act (HIPAA) uncertain.21 For example, differential privacy's noise injection technique may preserve anonymity but might not meet the legal threshold of effective anonymization in all jurisdictions.22
Semantic PETs, designed to support automated data protection impact assessments (DPIAs) and reasoning over data processing obligations, face challenges due to the absence of standard ontologies and the difficulty of integrating them with operational data systems.23
Financial Considerations and Scalability
The initial investment in PETs, including technology acquisition and staff training, can be substantial, depending on the specific PETs being implemented. Some PETs, such as confidential computing, are designed to integrate smoothly with existing production environments, minimizing disruption. However, other technologies may necessitate significant refactoring or the development of bespoke solutions, increasing both cost and implementation time. Additionally, scaling PET solutions to handle large datasets or operate within complex system architectures introduces further technical and operational challenges. These factors can act as barriers to adoption, particularly for enterprises with limited resources or highly dynamic data environments.24
Lack of Skilled Personnel and Trust in AI Systems
The shortage of trained human resources is a significant barrier to adopting PETs, particularly when integrated with AI-driven audit tools. Implementing PETs requires specialized knowledge of privacy and data protection and the underlying cryptographic and algorithmic methods that support these technologies. In the auditing context, the human resources gap is compounded by the need to upskill audit professionals, many of whom lack experience with emerging digital tools. Furthermore, trust in PET-enabled AI systems presents another major
challenge. The black box effect limits confidence in PET applications, as auditors may find it difficult to validate or rely on systems whose inner workings are not clearly understood. Overcoming these barriers requires interdisciplinary collaboration to standardize development tools, clarify legal requirements, and create PETs that are both effective and auditable.
Enhancing Data Security in IT Audits Through PETs
Due to the evolution of data privacy regulations, IT auditors must protect sensitive data while conducting effective audits. Traditional audit methods often expose PII, perpetuating legal and ethical risk. PETs allow auditors to minimize data exposure and uphold privacy without compromising audit quality. There are three areas where PETs improve data security: minimizing exposure, securing data processing, and reducing risk in cloud-based environments.
Minimizing Data Exposure During Audits
One of the most direct ways PETs can improve audit security is by reducing the exposure of sensitive personal data during the audit process. IT auditors frequently need access to user logs, transaction records, or other datasets that may contain PII. Direct access to this raw data introduces both privacy and compliance risk. To address this, auditors can leverage pseudonymization and anonymization tools that obscure or remove personal identifiers before analysis.
Pseudonymization replaces identifiable information with artificial labels, such as replacing usernames with unique codes. Anonymization takes this a step further by removing all identifiable data, making it extremely difficult to reidentify individuals. Tools such as ARX and sdcMicro allow enterprises to transform data using these techniques, ensuring that auditors can still perform meaningful analysis without compromising privacy.
While anonymization is not foolproof—linkage attacks using external datasets remain a risk—it provides a strong foundation for safer auditing. The goal should not be to eliminate all risk, which is virtually impossible, but to adopt a risk-reduction approach.25
Securing Data Access and Processing
IT auditors often assess systems that handle sensitive information such as salaries or health data. Accessing this data directly poses risk of exposure, breaches, and noncompliance. To reduce this risk, auditors can use homomorphic encryption, which allows data to be analyzed while it remains encrypted. Tools such as Microsoft SEAL help verify calculations (e.g., tax or payroll) without revealing the actual data.26 This approach protects privacy but may require advanced processing capabilities.
Another useful method is SMPC, which allows multiple parties to jointly analyze data without sharing their private inputs. Tools such as Sharemind are helpful in collaborative audits where enterprises need to protect sensitive information.27 The benefit is confidentiality across all sides, though the setup can be complex.
Reducing Audit Risk in Cloud and Outsourced Environments
Auditing cloud-based or outsourced systems presents challenges due to limited visibility and control. Trusted execution environments (TEEs) such as Intel SGX provide secure, isolated spaces where data can be processed safely. Auditors can confirm compliance without direct data access.28 ZKPs enable systems to prove that policies were followed (e.g., access controls do not expose sensitive details).29 This is especially useful for highly confidential systems. Additionally, blockchain offers tamper-proof logging. Platforms such as Hyperledger Fabric track data access and system changes transparently, improving trust and audit traceability.30 While effective, these tools can require technical integration.
PETs offer IT auditors practical tools to secure sensitive data while maintaining audit effectiveness. By adopting these solutions, auditors can reduce privacy risk, strengthen compliance, and build trust in increasingly complex digital environments.
Conclusion
Data privacy is a critical component of digital trust. PETs are no longer optional. They protect the ideals of confidentiality, integrity, and accountability through anonymization and encryption, as well as differential privacy and SMPC. Their incorporation into organizational processes improves compliance with data protection legislation such as the EU GDPR and South African Protection of Personal Information Act (POPIA),31 and fosters public trust in responsible data use.
Despite the significant promise of PETs, challenges remain. Implementation requires specialized expertise, robust governance structures, and a clear understanding of evolving legal standards. For IT auditors, assessing the effectiveness of PETs adds complexity to traditional audit procedures, calling for updated methodologies and interdisciplinary collaboration. Moving forward, auditors, technologists, and policymakers must work together to promote the scalable adoption of PETs, ensuring that privacy is preserved not as an afterthought but as a fundamental design principle in the digital age.
Endnotes
1 Cavoukian, A.; “Privacy by Design: The 7 Foundational Principles,” Information and Privacy Commissioner of Ontario, Canada, 2010
2 Seni.ar, V.; Jerman-Bla.i., B.; et al.; “Privacy-Enhancing Technologies—Approaches and Development,” Computer Standards & Interfaces, vol. 25, iss. 2, 2003, p. 147–158
3 MITRE, “Obfuscated Files or Information: Steganography”
4 Maram, D.; Malvai, H.; et al.; “CanDID: Can-do Decentralized Identity With Legacy Compatibility, Sybil-Resistance, and Accountability,” 2021 IEEE Symposium on Security and Privacy, 2021, p. 13481366
5 Čuřík P.; Ploszek, R.; et al.; “Practical Use of Secret Sharing for Enhancing Privacy in Clouds,” Electronics, 2022, p. 2758
6 Van Blarkom, G.W.; Borking, J.J.; et al. (Eds.); Handbook of Privacy and Privacy-Enhancing Technologies: The Case of Intelligent Software Agents, College bescherming persoonsgegevens, the Netherlands, 2003
7 Hadzic, S.; “South Africa's Digital Transformation: Understanding the Limits of Traditional Policies and the Potential of Alternative Approaches,” Computer Law & Security Review, vol. 55, 2024
8 Kigs, P.; “Government Surveillance, Privacy, and Legitimacy,” Philosophy & Technology, vol. 35, 2022
9 Zyskind, G.; Nathan, O.; et al.; "Decentralizing Privacy: Using Blockchain to Protect Personal Data," 2015 IEEE Security and Privacy Workshops, 2015
10 Reiners, S.; “Trust and its Extensions in Digital Platform Ecosystems: Key Concepts and Issues for Future Research,” 2022 IEEE 24th Conference on Business Informatics (CBI), 2022
11 Dwork, C.; “Differential Privacy: A Survey of Results” in Theory and Applications of Models of Computation, eds. Agrawal, M.; Du, D.; et al.; vol. 4978, Springer, Germany, 2008
12 Kairouz, P.; McMahan, B.; et al.; “Advances and Open Problems in Federated Learning,” Foundations and Trends in Machine Learning, vol. 14, iss. 1.2, 2021
13 Lindell, Y.; “ Secure Multiparty Computation (MPC),” Communications of the ACM, vol. 64, iss. 1, p. 86–96
14 Eichenmler, C.; Kuhn, L.; et al.; “My Whereabouts, My Location, it’s Directly Linked to My Physical Security”: An Exploratory Qualitative Study of Location-Dependent Security and Privacy Perceptions Among Activist Tech Users,” arXiv, 28 January 2025
15 Greenberg, A.; "The Grand Tor: How to Go Anonymous Online," Wired, 9 December 2017
16 International Committee of the Red Cross, “Data Protection in Humanitarian Action”
17 Hasani,T.; Rezania, D.; et al.; “Privacy Enhancing Technology Adoption and its Impact on SMEs’ Performance,” International Journal of Engineering Business Management, 2023
18 Information Commissioner’s Office, “Tackling Barriers to Privacy-EnhancingTechnologies Adoption – a PETs Project Report,” United Kingdom, 2023
19 Devs, O.; “Empowering Enterprises: 5 Challenges in the Adoption of Emerging Privacy-Enhancing Technologies and How to OvercomeThem,” Medium, 28 February 2024
20 ISACA®, Exploring Practical Considerations and Applications for Privacy Enhancing Technologies, 31 May 2024
21 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation [GDPR]) ; US Department of Health and Human Services, “The Security Rule”
22 Information Commissioner’s Office, “Tackling Barriers”; ISACA, Exploring Practical Considerations
23 Saniei, R.; “Challenges in the Implementation of Privacy Enhancing SemanticTechnologies (PESTs) Supporting GDPR” in International Workshop on AI Approaches to the Complexity of Legal Systems, eds. Rodríguez-Doncel, V.; Palmirani, M.; et al.; Springer, Cham, USA, 2021, p. 283–297
24 Devs, “Empowering Enterprises”
25 Rubinstein, I.; Hartzog, W.; “Anonymization and Risk,” Washington Law Review, vol. 91, iss. 2, 2016, p. 703–740
26 Bulut, Ö.; Homomorphic Encryption for Data Security in Cloud Computing, 2018
27 Merino, L.H.; Cabrero-Holgueras, J.; “Secure Multi-Party Computation,” ResearchGate, April 2023
28 Tian, H.; Wang, M.; et al.; “TEEMRDA: Leveraging Trusted Execution Environments for Multi-Replica Data Auditing,” ScienceDirect, 2024; Seni.ar, et al., “Privacy-EnhancingTechnologies”
29 Tang, X.; Shi, L.; et al.; “Zero-Knowledge Proof Vulnerability Analysis and Security Auditing,” International Association for Cryptologic Research, 2024
30 Asrow, K.; Samonas, S.; “Privacy Enhancing Technologies: Categories, Use Cases, and Considerations,” Federal Reserve Bank of San Francisco, 1 June 2021
31 Parliament of South Africa, Protection of Personal Information Act (POPI Act), South Africa
AYANDA MTHIMKHULU
Is a senior IT auditor with a focus on IT controls and application controls in external audits. She began her professional journey in data analytics, working as a business intelligence analyst within the financial services sector. She later transitioned into IT audit. Mthimkhulu is passionate about leveraging technology and data to drive business insights, enhance decision making, and support robust IT governance and risk management. She has also published research on the adoption of blockchain in the supply chain and logistics industry.
KIMENTHA GOVENDER
Is a junior IT auditor with a focus on IT controls and application controls in external audits. She also has a background in computer science and information systems.
LERATO RIBA
Is a junior IT auditor with a focus on IT controls in internal and external audits. She is passionate about implementing systems that strengthen trust in technology and enhance digital assurance.
MUHAMMED LOONAT
Is a junior IT auditor with a focus on IT controls and application controls in internal and external audits. His professional expertise also spans business process engineering, operational resilience, cyberincident response, and IT disaster recovery. He is particularly interested in the intersection of business and technology, with a focus on strengthening organizational resilience and ensuring alignment with industry best practices.
NANDE MBIXO
Is a junior IT auditor with a focus on IT controls in external audits. He is particularly interested in technology risk, data-driven assurance, and the application of emerging tools such as artificial intelligence (AI), cloud, and robotic process automation (RPA) to strengthen controls and enhance audit quality.