Privacy by design
Also called data protection by design and by default, privacy by default
Privacy by design means building data protection into systems, products and processes from the start rather than adding it later. Under GDPR it is a legal duty called data protection by design and by default. Firms must choose measures such as data minimisation and pseudonymisation, and collect only the personal data each purpose needs.
How it works
At a regulated firm, privacy by design starts when a new product, system or vendor is proposed. The privacy team reviews what personal data is needed and for how long. High-risk processing triggers a data protection impact assessment. Engineers set default settings to the most privacy-protective option, limit access and build in deletion. Decisions are documented so the firm can show accountability.
Financial firms process large volumes of sensitive customer data for onboarding, monitoring and credit decisions. Supervisory authorities can fine controllers that fail to apply Article 25, separately from any breach. The principle also shapes AI projects, where training data, retention and explainability need early design choices. Building controls in early is usually cheaper than rebuilding systems after an audit.
The rules
Controllers must implement technical and organisational measures to apply data protection principles and process only the personal data needed by default.
Controllers processing personal data of people in the EUKeeps the duty of data protection by design and by default. Since 5 February 2026 online services likely to be used by children must also weigh their higher protection needs.
Controllers processing personal data in the UKSets high-level requirements for building privacy protections into consumer products across their whole lifecycle.
Organisations designing consumer goods and servicesCommon questions
Is privacy by design a legal requirement?
Yes, in the EU and UK. Article 25 of GDPR and UK GDPR requires controllers to build data protection into processing and to apply privacy-protective defaults. Regulators can enforce this duty even where no data breach has occurred.
What does privacy by default mean?
Privacy by default means that, without any action by the user, a system processes only the personal data needed for each specific purpose. It limits how much data is collected, how long it is kept and who can access it.
How does a DPIA relate to privacy by design?
A data protection impact assessment is one of the main tools for privacy by design. GDPR requires it before processing likely to result in high risk to individuals. It records the risks identified and the measures chosen to reduce them.
