A common question is whether these rules apply directly to the engineers writing the code. Legally, the Article 25 obligation falls on the data controller, though implementation involves technical measures built by developers. Furthermore, under Article 25(3), an approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with these requirements. This guide breaks down the legal requirements of Article 25, building on our overview of GDPR Article 5 principles.
What is the difference between data protection by design and by default?
Data protection by design requires embedding privacy safeguards (like pseudonymisation) into the architecture of a system, while data protection by default requires configuring the system so that its out-of-the-box settings automatically ensure only data necessary for each specific purpose are processed.
While often grouped together, they target different aspects. "By design" (Article 25(1)) dictates the technical and organisational measures implemented. "By default" (Article 25(2)) dictates how the system behaves in its standard state before a user intervenes.
Article 25(1): Data protection by design
Under Article 25(1), the controller must implement appropriate technical and organisational measures (TOMs) designed to implement data protection principles effectively in order to meet the requirements of the GDPR and protect the rights of data subjects.
This obligation applies both at the time of the determination of the means for processing and at the time of the processing itself.
When selecting these measures, the controller must take into account four factors:
- The state of the art.
- The cost of implementation.
- The nature, scope, context and purposes of the processing.
- The risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing.
Article 25 explicitly names pseudonymisation as an example of an appropriate measure to implement principles like data minimisation effectively.
Article 25(2): Data protection by default
Article 25(2) mandates that controllers implement measures ensuring that, by default, only personal data which are necessary for each specific purpose are processed.
The regulation specifies that this default limitation applies across four dimensions:
- The amount of personal data collected.
- The extent of their processing.
- The period of their storage.
- Their accessibility: Personal data must not be made accessible without the individual's intervention to an indefinite number of natural persons.
Engineering examples & compliance
The GDPR places the Article 25 obligation on the controller, who must ensure the processing systems they use meet these standards, weighing the risks and available measures as outlined in EDPB Guidelines 4/2019.
If a company purchases a CRM system that lacks a way to delete old records, this may indicate a failure to meet Art. 25 on the part of the controller, depending on the risk and available alternative organisational measures (such as manual deletion routines).
| Concept | Poor practice | Good practice (compliance support) |
|---|---|---|
| By Design: Security | Storing user passwords in plain text or using outdated hashing (note: this relates heavily to Art. 32 as well). | Implementing modern hashing, reflecting the 'state of the art' based on risk assessment. |
| By Design: Architecture | Allowing broad access where every employee can see all customer data regardless of necessity. | Implementing Role-Based Access Control (RBAC) and pseudonymising datasets. |
| By Default: Collection | An app requests access to contacts and location immediately upon opening, before the feature is needed. | The app only requests location access when the specific feature requiring it is activated. |
| By Default: Visibility | A new user's profile is automatically accessible to an indefinite number of internet users without intervention. | The profile is visible only to a limited group by default, requiring the user to intervene to make it public. |
Frequently asked questions
What is the difference between data protection by design and by default?
Data protection by design means embedding privacy safeguards into the architecture of a system. Data protection by default means that the system's standard settings must ensure that only personal data necessary for each specific purpose are processed.
Does Article 25 apply to software developers or only to controllers?
Legally, Article 25 imposes obligations directly on the data controller to ensure systems meet these standards. While Recital 78 encourages producers to take data protection into account, the binding obligation falls on the controller. Processors have their own distinct obligations under provisions like Article 28.
Are Data Protection Impact Assessments (DPIAs) required by Article 25?
Article 25 does not require a DPIA. The obligation to conduct a DPIA arises exclusively under Article 35 when processing is likely to result in a high risk to rights and freedoms.
What does 'state of the art' mean in Article 25?
It is one of the factors controllers must take into account—alongside the cost of implementation, context, and risks—when selecting appropriate technical and organisational measures.