Recent controversies surrounding privacy have sparked a move by regulators toward the idea of privacy by design (PbD), a concept pioneered by Ontario Information and Privacy Commissioner Ann Cavoukian. Industry has also started to recognize the importance of taking privacy seriously, with various PbD corporate initiatives currently underway. However, some commentators have criticized PbD for being too vague. Using three case studies and a range of best practice examples of PbD, privacy impact assessments (PIAs), and privacy-enhancing technologies (PETs), this article addresses the gap between the abstract principles of PbD and their operationalization into more concrete implementation guidelines for software engineers.