Key points
- Privacy by design requires data protection to be built in from the moment a processing operation is designed.
- An obligation laid down in Article 25 of the General Data Protection Regulation.
- The controller must put in place appropriate technical and organisational measures.
- Privacy by default limits collection to the data strictly necessary for each purpose.
- Pseudonymisation is one example of a measure implementing the principles, including data minimisation.
- Measures are assessed according to the actual risk to the individuals concerned.
Privacy by design means data protection by design. It requires you to build personal data protection requirements in at the very moment you design a product, a service or a processing operation, not after its launch. The General Data Protection Regulation (GDPR) lays down this obligation in its Article 25. The controller must put in place appropriate technical and organisational measures as soon as the means of processing are determined. Every situation is different and calls for an analysis tailored to the nature of the data concerned.
What is privacy by design?
Definition
Privacy by design, or data protection by design, puts privacy at the heart of how a processing operation is designed. You no longer treat compliance as a layer added at the end of a project. You build it in from the first architecture decisions. This approach concerns developers, product teams and legal departments. It aims to reduce the risk to the individuals concerned before the first piece of data is even collected.
The General Data Protection Regulation, Regulation (EU) 2016/679, sets the framework for all the obligations. Its Article 5 sets out the core principles: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. Privacy by design turns these principles into concrete design choices. It links legal rules to technical decisions.
Privacy by design vs privacy by default
Privacy by default, or data protection by default, complements privacy by design. It requires that, by default, only the data strictly necessary for each purpose are processed. A form must not pre-tick boxes for optional collection. A social network must not make a profile public by default. Article 25 GDPR brings these two requirements together in a single provision. Design governs how the processing is built. Default settings govern the actual extent of collection.
What does the GDPR require?
The Article 25 obligation
Article 25 GDPR requires the controller to implement appropriate technical and organisational measures. These measures apply at the time the means of processing are determined, and then throughout the processing itself. The text expressly cites pseudonymisation as an example of a measure designed to implement data protection principles. It refers in particular to data minimisation.
The controller takes several factors into account to calibrate its measures. It considers the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. It also assesses the severity and likelihood of the risks to individuals’ rights and freedoms. The obligation is therefore not fixed. It is assessed in light of the actual risk the processing poses to the individuals concerned.
This obligation rests on the controller. In practice, it also affects the processor, which must provide sufficient guarantees. Compliance with Article 25 contributes to the demonstration of compliance required by the accountability principle. You must be able to prove, through your documentation, that data protection actually guided the design of the processing.
How to implement privacy by design
Technical and organisational measures
Implementation starts with mapping the data and the purposes. You identify which data are really necessary for each objective. You rule out unnecessary collection under the data minimisation principle. You set limited retention periods and automatic deletion rules. These choices are made before development, not after.
On the technical side, several levers reduce the risk. Pseudonymisation separates the data from the direct identity of individuals. Encryption protects data in transit and at rest. Access partitioning limits the people authorised to view the data. Default settings restrict visibility and collection. Each measure is documented to evidence the approach.
On the organisational side, governance structures compliance. The Data Protection Officer (DPO) advises teams upstream. Project reviews include a compliance checkpoint from the scoping phase. Developers receive clear instructions on data protection. The CNIL (French data protection authority) publishes recommendations and guides to support this approach. Its practical guides help turn principles into concrete measures.
Link with the data protection impact assessment (DPIA)
Privacy by design works hand in hand with the data protection impact assessment (DPIA). Article 35 GDPR requires this assessment where a processing operation is likely to result in a high risk to the rights and freedoms of individuals. The DPIA is carried out before the processing begins. It describes the processing, assesses the risks and details the measures envisaged to reduce them. It is the natural extension of privacy-conscious design. Our firm assists with this process; see our dedicated page on the GDPR data protection impact assessment.
Sanctions for non-compliance
Failure to comply with Article 25 exposes the controller to sanctions. For this infringement, the GDPR provides for administrative fines of up to €10 million or, for an undertaking, 2% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 83(4)). The amount takes into account, in particular, the seriousness of the infringement. The CNIL may also order corrective measures, such as a formal notice or a limitation of processing. Beyond the financial risk, an infringement damages user trust and the organisation’s reputation. Compliance by design is therefore as much a legal requirement as a risk management choice.
Legal support informs each design decision and helps make your processing operations legally sound. Our team works alongside product and technical departments. We help you document your choices and demonstrate your compliance. See our GDPR lawyer page and our page on personal data protection expertise. Every situation is different.
Privacy by design FAQ
What is privacy by design?
It is data protection by design. You build personal data protection requirements in when you design a processing operation, not after its launch, in accordance with Article 25 GDPR.
What is the difference between privacy by design and privacy by default?
Privacy by design governs how the processing is designed. Privacy by default requires that, by default, only the data strictly necessary for each purpose are processed. Article 25 brings these two requirements together.
Is privacy by design mandatory?
Yes. Article 25 GDPR requires the controller to implement appropriate technical and organisational measures as soon as the means of processing are determined.
How do you apply privacy by design?
You map the data, apply data minimisation, use pseudonymisation and encryption, restrict default settings and document your choices. A DPIA completes the approach where there is a high risk.
How does it relate to the GDPR DPIA?
Article 35 requires a DPIA where a processing operation presents a high risk. This assessment extends privacy by design by evaluating the risks and formalising the risk reduction measures before the processing begins.
Official sources on privacy by design
- Article 25 of Regulation (EU) 2016/679 (GDPR), data protection by design and by default – EUR-Lex
- Article 5 of Regulation (EU) 2016/679 (GDPR), principles relating to processing of personal data – EUR-Lex
- Article 35 of Regulation (EU) 2016/679 (GDPR), data protection impact assessment – EUR-Lex
- CNIL, “Ce qu’il faut savoir sur l’analyse d’impact relative à la protection des données (AIPD)” (What you need to know about the data protection impact assessment) – cnil.fr (in French)
This article sets out the current state of the law for general information purposes only. It does not constitute legal advice. Every situation is different and calls for a dedicated analysis. Content compliant with the professional conduct rules of the legal profession (avocats).
