Glossary
Data protection by design and by default
The GDPR Article 25 duty to build data protection into systems from the design stage and to process only necessary data by default.
Article 25 GDPR contains two related obligations. Article 25(1), data protection by design, requires the controller, both when determining the means of processing and at the time of processing, to implement appropriate technical and organisational measures, such as pseudonymisation, designed to implement data protection principles like data minimisation effectively and to integrate the necessary safeguards. Like Article 32, it takes into account the state of the art, cost, the nature, scope, context and purposes of processing, and the risks to individuals.
Article 25(2), data protection by default, requires that by default only personal data necessary for each specific purpose is processed. This applies to the amount of data collected, the extent of processing, the storage period and accessibility.
For security, IT and DevOps teams, Article 25 translates into engineering practice: collect only the fields you need, set retention periods and automatic deletion in the data model, restrict access by default, avoid copying production data into test environments, and apply pseudonymisation or encryption early. Infringements of Article 25 fall within the fine tier of Article 83(4). See our guide to data minimisation and retention.