What are privacy by design and privacy by default?
Privacy by design means the controller plans data protection into the technology and organization of a processing operation before it runs, and maintains it during operation. Privacy by default means a system processes out of the box only what the purpose requires; any further processing needs a deliberate change. Article 25 GDPR combines both duties under the title “Data protection by design and by default.”
| Paragraph | Content | Short form |
|---|---|---|
| Art. 25(1) | appropriate technical and organizational measures that implement the data protection principles effectively, when the means are determined and during processing | privacy by design |
| Art. 25(2) | default settings that in principle process only the data necessary for each specific purpose | privacy by default |
| Art. 25(3) | an approved certification mechanism under Article 42 as an element to demonstrate compliance | proof |
The GDPR guide shows how Article 25 fits with the Regulation's other duties.
What does privacy by design require under Article 25(1)?
Privacy by design requires measures at two points in time: “both at the time of the determination of the means for processing and at the time of the processing itself.” The duty therefore starts with the choice of a system, a service provider or an architecture and does not end at go-live.
The measures must implement the data protection principles effectively; the Regulation names pseudonymization as an example of a measure and data minimization as an example of a principle. Which measures are appropriate is a matter of weighing the state of the art, the cost of implementation and the nature, scope, context and purposes of processing. The likelihood and severity of the risks to the people concerned go into the same balance.
Recital 78 lists possible measures:
- minimizing processing;
- pseudonymizing data as soon as possible;
- transparency about functions and processing;
- enabling the data subject to monitor the processing;
- enabling the controller to create and improve security features.
What does privacy by default require under Article 25(2)?
Privacy by default requires that, by default, in principle only the data necessary for each specific purpose is processed. The duty applies to four dimensions:
| Dimension in Art. 25(2) | Question to ask | Privacy-friendly default |
|---|---|---|
| Amount of data collected | Which fields does the purpose need? | optional fields are empty, mandatory fields limited to what is needed |
| Extent of processing | What is the data used for? | analytics, profiling and newsletters are off until the person opts in |
| Storage period | How long is it needed? | the deletion period is configured in the system, not only described in the retention policy |
| Accessibility | Who can see it? | new profiles, documents and shares are not public, permissions start narrow |
The third sentence singles out one case: by default, personal data must not be made accessible without the individual's intervention to an indefinite number of natural persons. A profile that is public from the moment it is created is not compatible with that sentence, even if the person can restrict visibility later.
Design or default: where the difference lies
Privacy by design creates the option to process sparingly; privacy by default makes the system start there. A tool with an “analytics off” switch therefore does not meet Article 25(2) if the switch is set to “on” out of the box.
| Feature | Privacy by design | Privacy by default |
|---|---|---|
| Provision | Article 25(1) GDPR | Article 25(2) GDPR |
| Subject | design of technology and organization | preset values and starting settings |
| Yardstick | balance of state of the art, cost, processing and risk | necessity for the specific purpose |
| Examples | pseudonymization, encryption, tenant separation, deletion function | unticked consents, non-public profiles, short storage periods |
Checking the default settings of a purchased system: fictional example
If you use third-party or off-the-shelf software, the European Data Protection Board's Guidelines 4/2019 (version 2.0, para. 44) address this case. They say you should carry out a risk assessment of the product and make sure that functions without a legal basis or not compatible with the intended purposes are switched off. The following example shows such a check for a newly purchased applicant portal; the product and findings are invented for illustration.
In a test environment, create a new application and a new job posting without changing any settings, and record what the system does on its own:
| Dimension | Check | Expected | Finding (fictional) | Action |
|---|---|---|---|---|
| Amount | review the mandatory fields in the application form | only data needed for selection | date of birth and photo are mandatory | make both optional or remove them |
| Extent | open the analytics and talent pool settings | off until the person agrees | inclusion in the talent pool is preselected | remove the preselection |
| Storage period | look for the deletion rule for rejected applications | period configured in the system | no deletion rule active | configure the period from the retention policy |
| Accessibility | test sharing an application with the hiring department | sharing with named people | the share link works for anyone who has it | switch to named accounts (third sentence) |
For each row, record the date, the reviewer, a screenshot and the changed setting, and repeat the check after every major vendor update. If a default cannot be changed, you need another technical or organizational measure that ensures the same result, or a different product; document the decision.
Who is bound by Article 25 GDPR?
The controller is bound, meaning the body that decides on the purposes and means of processing. Manufacturers of software and devices are not direct addressees; under Recital 78 they “should be encouraged” to take data protection into account when developing and designing their products.
The duty still reaches manufacturers indirectly, because choosing the means itself falls under Article 25(1): whoever buys a product checks its design and default settings. Under Recital 78 the principles should also be taken into account in public tenders.
What counts as proof, and which fine applies?
Under Article 25(3), an approved certification mechanism under Article 42 may be used as an element to demonstrate compliance with paragraphs 1 and 2; it does not replace your own check. A management system certificate such as ISO 27701 is not in itself a mechanism under Article 42.
Infringements of Article 25 fall under Article 83(4)(a) GDPR: up to €10 million or up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. Collecting data without necessity or making it openly accessible can also breach the principles of Article 5, for which Article 83(5) provides up to €20 million or 4%.
Where do the seven principles of privacy by design come from?
Ann Cavoukian formulated the seven foundational principles as Information and Privacy Commissioner of the Canadian province of Ontario:
- proactive not reactive
- privacy as the default setting
- privacy embedded into design
- full functionality: positive-sum, not zero-sum
- end-to-end security across the full lifecycle
- visibility and transparency
- respect for user privacy
In the EU only the wording of Article 25 is legally binding, and it does not adopt these principles.
A new system on the asset register in Rizzqo
Rizzqo models a newly purchased system such as the applicant portal as a supporting asset under the primary assets it is meant to serve, such as the recruiting process. From them it inherits the confidentiality rating and the personal-data flag, so the entry shows at selection time that the system processes personal data. Requirements attach to the system by asset category and subcategory, and an assigned owner finalizes each answer with name and timestamp; the record of the default-settings check can be attached as evidence. The GDPR is modeled in Rizzqo as a taxonomy module.