Data protection by design

What it means

Data protection by design is the GDPR duty to build the protection of personal data into systems and processes from the design stage, not as an afterthought. It is complemented by data protection by default: a system should, by default, process only the data needed for the purpose.

In practice this means measures such as pseudonymisation, restricting access to those who need it, automatic deletion after the retention period, encryption, tracking switched off and optional form fields left blank by default. The data minimisation principle is thus translated directly into technical design.

The principle covers new applications, websites, internal processes and changes to existing systems. For higher-risk processing it is supplemented by a data protection impact assessment, which identifies risks and proposes measures before launch.

How it works in practice

When choosing a software or cloud provider, check which data protection settings it offers: role-based access, logging, encryption, the ability to delete and export data, and where the servers are. Retrofitting is more expensive than choosing well at the start.

On a website the principle shows in analytics and marketing cookies staying off until the visitor gives consent, forms asking only for necessary data and the newsletter box not being pre-ticked. Such settings also reduce the risk of complaints.

For internal processes, one simple question for every new project helps: which personal data do we really need, who will have access and when will we delete them? The answers are documented and serve as evidence of compliance in an inspection.

What to watch out for

The duty applies regardless of company size, though the measures are judged in proportion to risks and costs. A small online shop does not need a bank's solutions, but it must be able to explain why it chose the measures it has.

Quietly expanding data collection, such as marketing adding a new tracking script without review, is a common breach of this principle. Changes to websites and apps should therefore also pass a data protection check.