1. Definition

• Privacy by Design (PbD): Embedding data protection principles into the design of systems, processes, and technologies before they are deployed.
• Privacy by Default (PbDf): Ensuring that, by default, only the minimum necessary personal data is collected, processed, and retained — and that default system settings respect privacy.

GDPR Article 25 states that controllers must implement “appropriate technical and organisational measures” to meet these obligations, considering:

• State of the art,
• Cost of implementation,
• Nature, scope, context, and purposes of processing,
• Risks to rights and freedoms of natural persons.

2. How to Ensure Implementation (By Design)

• Early in project lifecycle: Apply PbD at the planning/design stage of any new system, process, or product.
• Risk assessments: Conduct a DPIA (Data Protection Impact Assessment) before high-risk processing.
• Integrate principles: Build in data minimization, pseudonymisation, encryption, access control, audit trails.
• Training: Ensure IT and business teams are trained to apply PbD principles when designing new solutions.
• Procurement: Require third-party vendors and processors to demonstrate PbD compliance in contracts.

3. How to Ensure Implementation (By Default)

• Minimal data collection: Systems should collect only data necessary for the specific purpose.
• Default settings: Privacy-friendly settings must be turned on by default (e.g., location tracking off unless user opts in).
• Retention limits: Personal data should not be stored longer than needed.
• Access controls: By default, only staff with a “need to know” can access PII.
• Transparency: Privacy notices should clearly explain defaults and options.

4. Sample Practical Applications

Example 1: Web Application

• By Design: System architects build user authentication with multi-factor login and encryption. DPIA is performed before launch.
• By Default: User profiles only display basic data (name and email). Sharing of personal data (phone, location) is opt-in.

Example 2: HR System

• By Design: HR software vendor integrates pseudonymisation for employee medical data.
• By Default: Only HR staff with medical clearance can view health information; payroll staff see only payroll data.

Example 3: Mobile App

• By Design: Developers integrate consent management modules and anonymization functions.
• By Default: Geolocation and contact sharing are switched off unless the user actively enables them.

5. Sample Policy Statement (for GDPR Manual)

Privacy by Design and Default Policy

In line with Article 25 GDPR, [Organization Name] ensures that data protection is embedded into all projects and business processes.

• At the design stage, all new systems and processes undergo a DPIA to identify and mitigate privacy risks.
• By default, only personal data strictly necessary for the intended purpose is collected and processed.
• Technical measures (e.g., pseudonymisation, encryption, access controls) and organisational measures (e.g., staff training, documented policies) are implemented to safeguard data.
• All IT systems are configured so that privacy-friendly settings are the default mode.
• Personal data retention is minimized, and access is restricted on a “need-to-know” basis.

This approach ensures that privacy and data protection are central to the organization's compliance framework and operational design.

✅ Summary:

• How? Integrate privacy measures at the design stage + enforce minimum/default privacy settings.
• When? Before and throughout the lifecycle of any system/process that processes personal data.
• Sample provided: Examples and policy statement for inclusion in GDPR documentation.