LINDDUN is a privacy threat modeling framework from the DistriNet research group at KU Leuven. Its seven categories are Linking, Identifying, Non-repudiation, Detecting, Data disclosure, Unawareness and Non-compliance. Use it alongside STRIDE when a system handles personal data, because the two share the same system model.
What the letters stand for
According to the LINDDUN site:
- Linking
- Identifying
- Non-repudiation
- Detecting
- Data disclosure
- Unawareness
- Non-compliance
Several of these differ from security thinking. Non-repudiation, a goal in security, is a privacy threat here, because a person may not want to be unable to deny an action. Unawareness covers people not knowing what happens to their data. Non-compliance covers breaking the rules that apply.
The same four questions
LINDDUN follows the common four question structure: what are we working on, what can go wrong, what are we going to do about it, and did we do a good job. The privacy analysis supports question two. You build a model of the system once and reuse it for both security and privacy passes.
Three ways to run it
The site describes variants for different depths:
- LINDDUN GO: a lean, card based brainstorming approach for quick sessions.
- LINDDUN PRO: a systematic analysis built on data flow diagrams.
- LINDDUN MAESTRO: model driven analysis, which the site lists as coming soon.
For a first attempt, the card approach is the lowest effort. Pick it when you have an hour and a diagram.
A short example
Say you add a feature that lets customers export usage reports with user names.
- Linking: can someone combine the export with another dataset to connect activity across systems?
- Identifying: does an anonymised field still point to one person?
- Detecting: can an outsider tell that a given person uses the product?
- Data disclosure: who receives the export, and is it protected in transit and at rest?
- Unawareness: do users know their names appear in reports?
- Non-compliance: does the export respect your retention and consent promises?
Each answer is a possible requirement or ticket.
How it fits with compliance work
The LINDDUN site says it supports privacy by design and complements GDPR compliance work with a technical, architecture focused view. It does not replace legal review. It gives engineers a structured way to find privacy problems before launch, which is cheaper than finding them after.
When to pick LINDDUN over STRIDE
Use STRIDE alone when the system holds little personal data and the main risks are about access and integrity. Add LINDDUN when you collect, combine, share or retain personal data, when a regulator or customer asks about privacy by design, or when you add analytics or profiling. OWASP's Threat Dragon tool lists LINDDUN support next to STRIDE, so you can record both in one model.
Quick check
Is LINDDUN a compliance standard?
No. It is a threat modeling method. It supports privacy work but does not certify anything.
Do I need to run STRIDE and LINDDUN separately?
You can reuse one diagram and run two passes. Separate passes keep the prompts clear.
Sources
Last reviewed: 19 October 2026.
