Privacy by design

The concept predates the GDPR. Ann Cavoukian, then Information and Privacy Commissioner of Ontario, formulated it in the 1990s as seven foundational principles: proactive not reactive; privacy as the default setting; privacy embedded into design; full functionality (positive-sum, not zero-sum); end-to-end security across the lifecycle; visibility and transparency; and respect for user privacy. The International Conference of Data Protection and Privacy Commissioners endorsed it by resolution in Jerusalem in 2010, and the GDPR turned it into a legal duty in Article 25.

Article 25(1) (data protection by design) requires the controller, both when determining the means of processing and during the processing itself, to implement appropriate technical and organisational measures, such as pseudonymisation, designed to implement the data protection principles of Article 5, for example data minimisation, effectively and to integrate the necessary safeguards. What is appropriate depends on the state of the art, the cost of implementation, the nature, scope, context and purposes of processing and the risks to individuals. Article 25(2) (data protection by default) requires that, by default, only personal data necessary for each specific purpose are processed, which applies to the amount collected, the extent of processing, the storage period and accessibility; in particular, data must not by default be made accessible to an indefinite number of people without the individual's intervention. Article 25(3) lets an approved certification mechanism under Article 42 serve as an element in demonstrating compliance, and infringements fall under the lower fine tier of Article 83(4), up to EUR 10 million or 2 % of worldwide turnover.

The EDPB's Guidelines 4/2019 on Article 25 (version 2.0, adopted in October 2020) stress that the obligation is on the controller, that "state of the art" is a moving target, and that effectiveness must be demonstrable, for example through key performance indicators. Processors and product vendors are not directly bound, but recital 78 encourages producers to take data protection into account, and controllers are expected to choose tools that allow them to comply.

Engineering translations include schema reviews that drop fields with no stated purpose, field-level pseudonymisation and tokenisation, retention implemented as automated deletion or TTLs rather than policy text, role-based access scoped to the purpose, aggregation, k-anonymity or differential privacy for analytics, client-side processing where possible, and privacy-protective defaults such as opt-in tracking and private-by-default profiles. Privacy by design differs from a DPIA under Article 35, which is a specific assessment triggered by high-risk processing, and from security by design, which protects all assets against attackers; a system can be well secured and still collect far more personal data than it needs.