When should a MedTech team run a LINDDUN analysis in addition to STRIDE?

Use privacy threat modeling where data processing raises privacy risks, particularly for connected services and analytics. Applicability of GDPR and HIPAA must be assessed separately; neither generally mandates LINDDUN.

What are LINDDUN GO and LINDDUN PRO?

LINDDUN GO is a lightweight, card-deck-based variant designed for quick workshop-style privacy threat identification early in design, while LINDDUN PRO is the full data-flow-diagram methodology that systematically walks a team through each of the seven privacy threat categories against every data flow and data store, producing a more rigorous and complete privacy threat inventory suited to formal design reviews.

What happens if a team identifies LINDDUN threats but skips the PET mapping step?

Record a treatment decision for each material privacy risk. Appropriate treatments may include minimization, access controls, workflow changes or PETs, but not every threat requires a PET or has the same suitable mitigation.

All terms

CybersecurityAI / ML in Devices Connected & Cyber-Physical Devices /lin-don/

LINDDUN

Privacy threat modeling framework that decomposes privacy threats into seven categories, the privacy counterpart to STRIDE.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

Definition

LINDDUN is a privacy threat-modeling methodology developed at KU Leuven. Current threat types are Linking, Identifying, Non-repudiation, Detecting, Data disclosure, Unawareness and unintervenability, and Non-compliance. GO supports lightweight workshops; PRO supports systematic analysis. Record privacy threats and select appropriate treatments.

What the regulation says

LINDDUN is an optional privacy-engineering method, not a named general FDA or HIPAA mandate. Specific ENISA, EDPB or notified-body endorsement claims require the exact original passage before publication.

What this means in practice

LINDDUN can complement security threat modeling for identifiable health data. GDPR Article 25 addresses data protection by design and default; HIPAA imposes applicable privacy and security duties but does not specifically mandate a LINDDUN or GDPR-style privacy-by-design analysis.

Examples

Illustrative: A MedTech manufacturer uses LINDDUN to identify potential re-identification risks in aggregated patient physiological data collected from a wearable device before it is shared with a research institution.
Illustrative: During the development of a new cloud-based diagnostic imaging system, a LINDDUN analysis uncovers detectability threats related to user activity patterns that could indirectly reveal sensitive health conditions.
Illustrative: A team designing a digital therapeutic app applies LINDDUN to ensure proper handling of user consent and data retention, addressing non-compliance and unawareness threats concerning data processing practices.

Common pitfalls

•Running STRIDE only and assuming privacy is covered, STRIDE addresses security; LINDDUN addresses privacy, and they identify different threats.
•Skipping the PET (privacy-enhancing technology) mapping, without it, LINDDUN produces threats with no controls.
•Limiting LINDDUN to the data layer, privacy threats also arise from UI design (Unawareness) and process design (Non-compliance).

Frequently asked questions

STRIDE identifies security threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), while LINDDUN identifies privacy-specific threats across seven categories, Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, and Non-compliance, that STRIDE does not systematically surface, such as re-identification of pseudonymized data or inference of sensitive attributes from aggregated data. The two frameworks are complementary and are often applied together against the same data flow diagrams.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Cybersecurity

De-Identification of Health Data

The HIPAA-defined process of removing identifiers from PHI so the resulting data is no longer subject to the Privacy Rule.

Cybersecurity

HIPAA(HIPAA)

U.S. federal law governing the privacy and security of protected health information.

Cybersecurity

PHI and ePHI

Individually identifiable health information (PHI) and its electronic form (ePHI) - the data class HIPAA protects.

Cybersecurity

Premarket Cybersecurity Submission

The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

More in Cybersecurity

· Same category

Cybersecurity

STRIDE Threat Model(STRIDE)

A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

Cybersecurity

Threat Modeling

A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.

Cybersecurity

AAMI SW96

AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.

Cybersecurity

AAMI TIR57

AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (2)

Latest in MedTech

Sources

4 sources

Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Official-source claim check: 2026-11-01

LINDDUN is a voluntary privacy threat-modeling methodology with seven current threat types.

Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.

Remaining verification limits

Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.

Tier 2Regulator guidance and consensus· 3Tier 4Trade press and expert commentary· 1

Link health: 3 verified 1 unchecked· last checked 2026-06-20

KU Leuven·2ENISA·1HSCC·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Cybersecurity0 / 61

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Cybersecurity
Sources: 4
Updated: 6/20/2026

Compare with another term

Learn in 60 seconds

Privacy threat modeling framework that decomposes privacy threats into seven categories, the privacy counterpart to STRIDE.

·LINDDUN can complement security threat modeling for identifiable health data.
·Current threat types are Linking, Identifying, Non-repudiation, Detecting, Data disclosure, Unawareness and unintervenability, and Non-compliance.
·GO supports lightweight workshops; PRO supports systematic analysis.

Remember this

Watch out: Running STRIDE only and assuming privacy is covered, STRIDE addresses security; LINDDUN addresses privacy, and they identify different threats.

Related terms

You may also need

Auto-suggested from Cybersecurity and shared keywords.

All Cybersecurity terms

From the Blue Goat network

Related resources and services on this topic.