Article 25 turns the principles into an engineering obligation. ControllersControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. must implement appropriate measures, both when deciding how to process and when processing, designed to put the principles into effect and protect people’s rights. That is by design. And by default, only the personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. necessary for each purpose should be processed. That is by default.
By design: build the principles in
Taking account of the state of the art, the cost, and the nature, scope, context and purposes of the processing and its risks, design choices should make compliance the path of least resistance:
| Principle | Design choice |
|---|---|
| Minimisation | Collect only the fields the purpose needs; prefer derived values |
| Purpose limitation | Separate datasets by purpose; tag data with its purpose |
| Storage limitation | Retention built into the data model, with automatic deletion |
| Accuracy | Validation at entry; a route for people to correct data |
| Security | PseudonymisationPseudonymisationReplacing identifiers so data cannot be attributed to a person without separately held information. Pseudonymised data is still personal data, unlike truly anonymous data., encryption, access by role |
| Transparency | Notices at the point of collection, in the interface |
| Rights | Self-service access and deletion where it is safe |
By default: the most private setting first
By default, settings should limit the amount of data collected, the extent of processing, the storage period and accessibility. In particular, personal data should not be made accessible to an indefinite number of people without the person’s intervention. Public profiles, location sharing and data sharing with partners should be off until switched on.
When it applies
At the time the means of processing are determined, which is design, procurement and configuration, and throughout processing. It applies to off-the-shelf products you deploy: choosing and configuring a tool is determining the means.
Evidence
Article 25 is hard to prove after the event, so record decisions as you make them:
- design reviews with a privacy item on the agenda;
- the DPIADPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people., where one is needed, with the alternatives considered;
- configuration baselines showing the private default;
- the retention rule in the data model, not just the policy.
Children’s services
For online services likely to be accessed by children, by default means high privacy by default under the Age Appropriate Design Code, and since 2026-02-05 the design must take account of children’s higher protection matters.
For a complaint
“The setting was public by default” or “there was no way to delete my account in the app” are Article 25 points, and they are concrete. Describe what the design made you do.