Data Protection by Design & Default: What It Means and How to Apply It

What "Data Protection by Design & Default" Means

The General Data Protection Regulation (GDPR) introduces two crucial obligations for organisations handling personal data:

• Data protection by design: Organisations must implement technical and organisational safeguards at the earliest stage of processing operations so that privacy becomes part of the system from the start.
• Data protection by default: Organisations must configure systems so that, by default, only the minimum necessary personal data are processed, storage periods are short, and accessibility is limited.

These two concepts are outlined in Article 25 of the GDPR and Recital 78.

---

🛠 What This Looks Like in Practice

Data Protection by Design

From the beginning of development or process setup, organisations should build in safeguards. Examples include:

• Pseudonymisation: Replacing identifiable information (like a user's real name) with an artificial identifier.
• Encryption: Encoding data so only authorised persons can access it.
• Minimised storage: Designing systems so only the data actually needed for the purpose are collected.

Additional example: A SaaS product designing its onboarding for the first time ensures that no personal data are collected until the user explicitly opts in, and each data field is required only if truly needed.

Data Protection by Default

Systems should be configured out of the box to apply the most protective settings. Examples include:

• A social-media platform setting user profiles to private by default so that they are not accessible to an indefinite number of persons.
• Defaulting user dashboards to show minimal personal information unless the user chooses to make it visible.

Additional example: A payment-processing tool ensures that personal payment history is visible only to the user and internal auditors by default—not to other internal staff by default.

---

Why It Matters for Your Business

These obligations are not just legal formalities—they carry real risk if ignored:

• Regulators expect you to demonstrate that safeguards have been built in from the start (not retrofitted).
• Customers and partners increasingly demand vendor transparency, documentation of controls and vendor compliance.
• Failure to apply design or default protections can lead to significant fines, reputation damage, or contractual termination.

---

✅ How to Apply It Right

1. Map your data flows and processing operations early in your design phase.
2. Embed safeguards (like encryption, access controls, data-minimisation) into your architecture not as after-thoughts.
3. Configure settings to the most protective mode by default, and allow users to opt-in for lesser protections when justified.
4. Document your decisions:why certain data fields exist, why storage is set as it is, who can access what. This helps with audits and compliance questionnaires.
5. Review continuously:every time you change your stack, add a new feature, or onboard a new vendor, check your settings and data flows against "design & default" standards.

---

🎯 Final Thought

"Data protection by design and by default" might sound technical but at its heart, it's simple: build your systems with privacy in mind, and set them to the most protective mode before you ever collect a single data point.
By doing so, you embed trust, reduce risk, and demonstrate compliance proactively.

*Originally based on the article: "What does data protection 'by design' and 'by default' mean?" European Commission