GDPR Q27
What is Privacy by Design?
Q27. What is Privacy by Design?
Category: Design
Privacy by Design (and by Default) means building privacy into products and processes from the outset.
In simple terms
- Consider privacy risks before you start a project.
- Default settings should collect only what is necessary.
- Document decisions to show accountability.
Design principles
Article 25 requires controllers to implement appropriate technical and organisational measures during design and throughout the lifecycle.
- Use data minimisation, pseudonymisation, and segregation of duties.
- Ensure default settings are privacy-friendly—for example, opt-in rather than opt-out.
- Provide users with easy access to their data and controls.
Embedding privacy
Integrate privacy checkpoints into project governance, procurement, and change management.
- Include privacy reviews in design sprints and go-live gates.
- Work closely with your DPO or privacy lead when developing new services.
- Test features with diverse users to uncover privacy concerns early.
Practical steps to take
- Add privacy requirements to project briefs and business cases.
- Complete DPIA screenings and full DPIAs where needed.
- Set privacy KPIs, such as minimised data fields or reduced retention.
- Review privacy controls after launch and during updates.
- Train product teams on privacy design patterns.
Real-life examples
New mobile app
A developer designs registration with minimal mandatory fields and allows users to download or delete their data.
CRM configuration
A charity configures its CRM to hide sensitive fields from most users and to automatically delete dormant records.
Helpful reminders
- Privacy by design is continuous—revisit when features change.
- Document design decisions to evidence compliance.
- Involve security, legal, and UX teams in design discussions.
Key takeaway
Build privacy in, don’t bolt it on—doing so reduces risk and builds user trust.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.