When should a MedTech team run a LINDDUN analysis in addition to STRIDE?

LINDDUN is particularly important for cloud-connected software as a medical device, AI/ML devices that retain inference logs, remote patient monitoring platforms, and digital therapeutics that process protected health information, since these systems raise re-identification and linkability risks that a purely security-focused STRIDE analysis will not catch, and both GDPR and HIPAA expect documented privacy-by-design analysis for such systems.

What are LINDDUN GO and LINDDUN PRO?

LINDDUN GO is a lightweight, card-deck-based variant designed for quick workshop-style privacy threat identification early in design, while LINDDUN PRO is the full data-flow-diagram methodology that systematically walks a team through each of the seven privacy threat categories against every data flow and data store, producing a more rigorous and complete privacy threat inventory suited to formal design reviews.

What happens if a team identifies LINDDUN threats but skips the PET mapping step?

Skipping the mapping of identified privacy threats to privacy-enhancing technologies (PETs) and controls produces a list of theoretical privacy risks with no corresponding mitigation plan, which provides little practical value to engineering teams or regulators reviewing the analysis; a complete LINDDUN exercise should end with specific controls, such as differential privacy, k-anonymity, or data minimization, assigned to each identified threat.

All terms

CybersecurityAI / ML in Devices Connected & Cyber-Physical Devices /lin-don/

LINDDUN

Privacy threat modeling framework that decomposes privacy threats into seven categories, the privacy counterpart to STRIDE.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

Definition

LINDDUN is a privacy-focused threat modeling methodology developed at KU Leuven. The acronym names seven privacy threat categories: Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, and Non-compliance. LINDDUN GO (a lightweight card-deck variant) and LINDDUN PRO (a full data-flow-diagram methodology) walk teams through identifying privacy threats in each category against data flows and stores. Output is a prioritized set of privacy threats with mappings to privacy-enhancing technologies (PETs) and controls.

What the regulation says

Not specifically cited by FDA, but recommended as a privacy threat modeling approach by ENISA, referenced in the EDPB Data Protection by Design guidelines, and increasingly cited by notified bodies reviewing EU MDR Annex I privacy and data protection requirements.

What this means in practice

For medical devices that process PHI or generate identifiable health data, and especially for cloud-connected SaMD, AI/ML devices that retain inference logs, and digital therapeutics, LINDDUN complements STRIDE by surfacing threats STRIDE doesn't cover (re-identification of pseudonymized data, inference of sensitive attributes, linkability across datasets). EU GDPR and HIPAA both expect privacy-by-design analysis; LINDDUN is the most rigorous public methodology for it.

Examples

A MedTech manufacturer uses LINDDUN to identify potential re-identification risks in aggregated patient physiological data collected from a wearable device before it is shared with a research institution.
During the development of a new cloud-based diagnostic imaging system, a LINDDUN analysis uncovers detectability threats related to user activity patterns that could indirectly reveal sensitive health conditions.
A team designing a digital therapeutic app applies LINDDUN to ensure proper handling of user consent and data retention, addressing non-compliance and unawareness threats concerning data processing practices.

Common pitfalls

•Running STRIDE only and assuming privacy is covered, STRIDE addresses security; LINDDUN addresses privacy, and they identify different threats.
•Skipping the PET (privacy-enhancing technology) mapping, without it, LINDDUN produces threats with no controls.
•Limiting LINDDUN to the data layer, privacy threats also arise from UI design (Unawareness) and process design (Non-compliance).

Frequently asked questions

STRIDE identifies security threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), while LINDDUN identifies privacy-specific threats across seven categories, Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, and Non-compliance, that STRIDE does not systematically surface, such as re-identification of pseudonymized data or inference of sensitive attributes from aggregated data. The two frameworks are complementary and are often applied together against the same data flow diagrams.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Cybersecurity

De-Identification of Health Data

The HIPAA-defined process of removing identifiers from PHI so the resulting data is no longer subject to the Privacy Rule.

Cybersecurity

HIPAA(HIPAA)

U.S. federal law governing the privacy and security of protected health information.

Cybersecurity

PHI and ePHI

Individually identifiable health information (PHI) and its electronic form (ePHI) - the data class HIPAA protects.

Cybersecurity

Premarket Cybersecurity Submission

The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

More in Cybersecurity

· Same category

Cybersecurity

STRIDE Threat Model(STRIDE)

A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

Cybersecurity

Threat Modeling

A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.

Cybersecurity

AAMI SW96

AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.

Cybersecurity

AAMI TIR57

AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (2)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 2Regulator guidance and consensus· 2Tier 4Trade press and expert commentary· 1

Link health: 3 verified· last checked 2026-06-20

KU Leuven·1ENISA·1HSCC·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Cybersecurity0 / 61

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Cybersecurity
Sources: 3
Updated: 6/20/2026

Compare with another term

Learn in 60 seconds

Privacy threat modeling framework that decomposes privacy threats into seven categories, the privacy counterpart to STRIDE.

·EU GDPR and HIPAA both expect privacy-by-design analysis; LINDDUN is the most rigorous public methodology for it.
·The acronym names seven privacy threat categories: Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, and Non-compliance.
·LINDDUN GO (a lightweight card-deck variant) and LINDDUN PRO (a full data-flow-diagram methodology) walk teams through identifying privacy threats in each category against data flows and stores.

Remember this

Watch out: Running STRIDE only and assuming privacy is covered, STRIDE addresses security; LINDDUN addresses privacy, and they identify different threats.

Related terms

You may also need

Auto-suggested from Cybersecurity and shared keywords.

All Cybersecurity terms

From the Blue Goat network

Related resources and services on this topic.