diff --git a/common.js b/common.js
index dffd56cc..a2a7e4f5 100644
--- a/common.js
+++ b/common.js
@@ -159,6 +159,15 @@ var ccg = {
       ],
       status: "Draft Community Group Report",
       publisher: "Credentials Community Group"
+    },
+    "PRIVACY-BY-DESIGN": {
+      title: "Privacy by Design",
+      href: "https://iapp.org/media/pdf/resource_center/pbd_implement_7found_principles.pdf",
+      authors: [
+        "Ann Cavoukian"
+      ],
+      date: "2011",
+      publisher: "Information and Privacy Commissioner"
     }
   }
 };
diff --git a/index.html b/index.html
index 028dfcb3..dd4e70ad 100644
--- a/index.html
+++ b/index.html
@@ -4182,15 +4182,16 @@ <h1>
 
     <p>
 It is critically important to apply the principles of Privacy by Design
-to all aspects of the <a>decentralized identifier</a> architecture, because
-<a>DIDs</a> and <a>DID documents</a> are, by design, administered directly by
-the <a>DID controller(s)</a>. There is no registrar, hosting company, or other
-intermediate service provider to recommend or apply additional privacy
-safeguards. The authors of this specification have applied all seven Privacy by
-Design principles throughout its development. For example, privacy in this
-specification is preventative not remedial, and privacy is an embedded default.
-Furthermore, the <a>decentralized identifier</a> architecture by itself embodies
-principle #7, "Respect for user privacy &mdash; keep it user-centric."
+[[PRIVACY-BY-DESIGN]] to all aspects of the <a>decentralized identifier</a>
+architecture, because <a>DIDs</a> and <a>DID documents</a> are, by design,
+administered directly by the <a>DID controller(s)</a>. There is no registrar,
+hosting company, or other intermediate service provider to recommend or apply
+additional privacy safeguards. The authors of this specification have applied
+all seven Privacy by Design principles throughout its development. For example,
+privacy in this specification is preventative not remedial, and privacy is an
+embedded default. Furthermore, the <a>decentralized identifier</a>
+architecture by itself embodies Privacy by Design principle #7: "Respect for
+user privacy &mdash; keep it user-centric."
     </p>
 
     <p>