Privacy by Design
Definition
The GDPR obliges controllers to implement appropriate technical and organizational data protection measures already when determining the means of processing and during processing.
Privacy by design means integrating data protection already during the planning and implementation of processing. Appropriate technical and organizational measures should, for example, limit the amount of data and protect personal data. Privacy-friendly defaults ensure that only the data necessary for the respective purpose are processed.
Simply explained
Like fire protection in the building plan: It is planned before the walls are built.
Why it matters in practice
Data protection must be planned early for websites, forms, and AI applications involving personal data. Article 25 GDPR requires technical and organizational measures for this; violations can trigger substantial fines.
Example from business
Possible example (hypothetical): An agency designs a contact form so that only mandatory fields are requested and inquiries are automatically deleted after completion.
Limits and pitfalls
- Checking data protection only before launch is not enough. Data-hungry defaults, missing deletion concepts, and mere privacy policies do not replace effective measures; their verification remains necessary during ongoing operation.
Origin & history
Article 25 of the GDPR from 2016 enshrines privacy by design and privacy-friendly defaults. Recital 78 mentions data minimization, pseudonymization, and transparency, among others. The European Data Protection Board published guidelines for consultation in 2019 and adopted the revised version in 2020.
Use in mid-sized companies
- Possible applications: Planning forms and customer portals, selecting AI tools, configuring analytics tools, deletion and role concepts.
Frequently asked questions
What does Article 25 GDPR require?
Appropriate technical and organizational measures as well as privacy-friendly defaults. Certifications can contribute to proof.
Is a privacy policy sufficient?
No. Only necessary data should be processed; information must also appear in the appropriate context.
Does the obligation apply directly to software manufacturers?
Article 25 is addressed to controllers. Manufacturers and processors support implementation; controllers must choose suitable providers.
Sources
- Verordnung (EU) 2016/679 (DSGVO), Art. 25, Art. 83 Abs. 4 und Erwägungsgrund 78 · Europäisches Parlament und Rat (2016): Verordnung (EU) 2016/679 (DSGVO), Art. 25, Art. 83 Abs. 4 und Erwägungsgrund 78
- Guidelines 4/2019 on Article 25 Data Protection by Design and by Default (Version 2.0) · EDPB (2020): Guidelines 4/2019 on Article 25 Data Protection by Design and by Default (Version 2.0)
Sources checked on 14.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: