The design of the ITER tritium systems must ensure that the public is protected from operational and accidental tritium release and that worker exposures are minimized. The ITER public exposure limits are consistent with international recommendations and the As Low As Reasonably Achievable (ALARA) concept is being implemented. We describe design approaches that will allow us to achieve these objectives. Although the design is still in its early stages, we have estimated the tritium flows and inventories and have started the safety analysis. Operational and accidental releases from ITER have not yet been determined, but we have used experience from other facilities to estimate ITER releases.