GDPR Privacy by Design

Privacy by design – formally called data protection by design – is a requirement under Article 25(1) GDPR. It obliges controllers to implement appropriate technical and organisational measures at the time of determining the means for processing and at the time of the processing itself, in order to effectively implement data protection principles such as data minimisation. In practice, this means data protection is not added retrospectively but built into the system architecture from the outset. The measures must reflect the state of the art, the cost of implementation, the nature and scope of the processing, and the risks to data subjects.

Article 25 GDPR explicitly mentions pseudonymisation as an example. Beyond that, relevant measures include encryption of personal data in transit and at rest, data minimisation by collecting only strictly necessary data, purpose limitation through technical access restrictions, automatic deletion after retention periods expire, access controls on a need-to-know basis, and anonymisation wherever possible. The European Data Protection Board (EDPB) recommends in its Guidelines 4/2019 that these measures be implemented throughout the entire data processing lifecycle.

Privacy by design (Article 25(1) GDPR) concerns the fundamental system design: data protection is built into architecture and processes from the start. Privacy by default (Article 25(2) GDPR) concerns default settings: by default, only the personal data necessary for each specific purpose may be processed. This applies to the amount of data collected, the extent of processing, the storage period and accessibility. For example: privacy by design means developing a contact form so that it technically only permits necessary fields. Privacy by default means optional fields are not enabled by default.

Violations of Article 25 GDPR can incur fines of up to EUR 10 million or 2% of total worldwide annual turnover under Article 83(4) GDPR – whichever is higher. In practice, supervisory authorities have already imposed fines where organisations failed to integrate data protection from the outset. Beyond financial risk, reputational damage and loss of trust among customers and business partners can have lasting effects. An early privacy by design strategy is therefore not only a legal requirement but a sound business decision.

Implementing privacy by design follows several steps: first, a data protection impact assessment (DPIA) is conducted to identify risks. Then technical measures such as pseudonymisation, encryption and access controls are selected and implemented. Organisationally, data protection requirements are integrated into the development process – for example through data protection checklists in sprint planning or mandatory DPIAs before introducing new processing activities. The effectiveness of measures must be regularly reviewed and adapted to the state of the art. ADVISORI guides you through all of these steps and ensures your documentation meets supervisory authority requirements.