GDPR Article 25: Privacy by Design and by Default

Article 25 requires controllers to implement appropriate technical and organisational measures that implement data-protection principles effectively and integrate necessary safeguards into processing — both by design and by default.

Related: GDPR hub · Principles · DPIA.

By default: Only personal data necessary for each specific purpose should be processed by default — volume, extent of processing, storage period, and accessibility.

Privacy by Design

Threat-model personal data flows before feature launch
Choose encryption, pseudonymisation, and access models early (ties to Art 32)
Run DPIAs (Art 35) when high risk is likely
Document design decisions as accountability evidence (Art 5(2))

Privacy by Default

Default settings favour the least personal data and the shortest retention
Optional fields stay optional; analytics off until consented where required
Admin roles start narrow; broaden only with justification

How CyberSilo Helps

CSA flags new processing without design/DPIA artefacts
ThreatHawk validates that default logging and access controls match the design

Bake Privacy into the Release Checklist

Treat Article 25 as a go-live gate: minimisation, defaults, and security measures before production traffic.

Talk to CyberSilo GDPR Automation

Frequently Asked Questions

Does Article 25 require a specific technology?

No. It requires appropriate measures implementing the principles effectively, including by default settings that minimise data.

How does Article 25 relate to DPIAs?

DPIAs (Art 35) are a key design tool when processing is likely high risk; Article 25 is broader and applies to all processing.

Who is responsible?

The controller. Processors support via Art 28 contracts and technical measures.

GDPR hub · DPIA · Article 32 · CSA

GDPR Article 25: Privacy by Design and by Default

Privacy by Design

Privacy by Default