GDPR Article 25: Privacy by Design and by Default

Privacy by Design

• Threat-model personal data flows before feature launch
• Choose encryption, pseudonymisation, and access models early (ties to Art 32)
• Run DPIAs (Art 35) when high risk is likely
• Document design decisions as accountability evidence (Art 5(2))

Privacy by Default

• Default settings favour the least personal data and the shortest retention
• Optional fields stay optional; analytics off until consented where required
• Admin roles start narrow; broaden only with justification

How CyberSilo Helps

• CSA flags new processing without design/DPIA artefacts
• ThreatHawk validates that default logging and access controls match the design

Frequently Asked Questions

Does Article 25 require a specific technology?

No. It requires appropriate measures implementing the principles effectively, including by default settings that minimise data.

How does Article 25 relate to DPIAs?

DPIAs (Art 35) are a key design tool when processing is likely high risk; Article 25 is broader and applies to all processing.

Who is responsible?

The controller. Processors support via Art 28 contracts and technical measures.

Related GDPR Resources

GDPR hub · DPIA · Article 32 · CSA