Use TLS for data in transit and appropriate encryption at rest for databases, backups, and object storage. Key management matters as much as encryption: control who can use keys, rotate them, audit access, and plan recovery. Encryption does not protect data from an application identity that is legitimately authorized but compromised.

Collect only data needed for a defined purpose. Establish retention and deletion policies, support access controls, and consider backups, replicas, caches, search indexes, and logs when implementing deletion. Privacy requirements should be reflected in architecture and operations rather than added at launch.

Rate limits protect services from accidental spikes and malicious abuse. Limits can be keyed by user, API key, IP, tenant, or resource cost. A fixed window is simple but can allow boundary bursts; token bucket allows controlled bursts; sliding-window methods provide more precise limits at extra cost. Pair rate limiting with quotas, anomaly detection, and graceful error responses.