Privacy by Design
Data protection by design — Art. 25 GDPR
TL;DR
Privacy by Design (Art. 25(1) GDPR) is the obligation to integrate data protection principles (Data Minimisation, Purpose Limitation, transparency) into the design of systems and processes from the outset — not retrospectively.
What is Privacy by Design?
Art. 25 GDPR distinguishes two levels:
- Privacy by Design: data protection in the system architecture (Pseudonymisation, encryption, access restriction)
- Privacy by Default: privacy-friendly default settings (for example, profile = private instead of public)
Both apply cumulatively. Infringements fall under Art. 83(4)(a) — up to EUR 10 million or 2% of worldwide annual group turnover.
Practical example
SaaS provider X is planning a new HR tool. Privacy by Design requires: 1) Data Minimisation in the input forms (only what is genuinely necessary), 2) Pseudonymisation in reports, 3) access restriction by role, 4) default = only the direct line manager sees performance data, not everyone.
Frequently asked questions
Who is liable for Privacy by Design infringements?
The Controller (Art. 24 GDPR). Processors and suppliers can be placed under corresponding obligations under Art. 28.
When does the obligation start?
Before any new development or substantial change. For existing systems: at the next modification.
Is a DPIA sufficient?
A DPIA (Art. 35) is part of Privacy by Design, but not the whole of it. PbD is broader.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are a compliance specialist, not a law firm. For legally binding information, consult a qualified lawyer.