Planning for privacy first requires strategic thinking.