menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Ukraine) language
Contact our local member in Ukraine mail_outline
Visit the website of Arzinger account_balance

arrow_backPrevious Article
Article 25
Next Articlearrow_forward

Data protection by design and by default

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 25 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 25 keyboard_arrow_up

Articles related to article 25

Key words related to article 25

Show the recitals of the Regulation related to article 25 keyboard_arrow_down Hide the recitals of the Regulation related to article 25 keyboard_arrow_up

(78) The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features. When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations. The principles of data protection by design and by default should also be taken into consideration in the context of public tenders.

There is no recital in the Directive related to article 25.

The GDPR

Article 25 defines the obligations of the controller resulting from the principles of data protection by design and data protection by default.

The objective of European legislature is to make the protection of fundamental rights more effective and more dynamic, by strengthening the classic principles of necessity, proportionality, purpose and transparency with new principles such as data protection by design (see Article 25 (1)) and data protection by default (see Article 25 (2)).

The purpose of these principles is to take into account the rights and the interests of individuals since the very data processing design and the settings by default.

According to paragraph 1 of article 25, the principle of data protection by design requires the controller to implement appropriate technical and organizational measures, both at the time of the determination of the means for processing and at the time of the processing itself, to make it complying with the Regulation, taking into account the processing-related risks. 

The measures to be adopted must take account of available technologies, the costs associated with their implementation as well as the nature, the scope, the context and the purpose of the processing as well as the probability and the severity of the risk presented by the processing with respect to the rights and freedoms of individuals.

Among these measures, paragraph 1 indicates minimisation and pseudonymisation. The notion of pseudonymisation must be understood as "the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person" (Art.. 4 (5)). On the other hand, the notion of minimisation is not subject to any definition in the Regulation but is explained in Article 5 (c).

Pursuant to this principle, new innovative and responsible techniques need to be developed to facilitate the exercise of individual rights to object, to access, to opt-out, to rectification and the right to data portability (see EDPS, Opinion 7/2015 of 19 November 2015, p. 14 et seq.).

The second paragraph addresses the principle of data protection by default. This principle requires the controller to adopt measures to limit by default the personal  data processing to what is strictly necessary, with regard to the amount of data processed, their accessibility and the period of their storage. For example, when the processing is not intended to provide information to the public, the principle of data protection by default requires the implementation of mechanisms guaranteeing that by default, the data is rendered inaccessible to an undetermined number of individuals, without intervention by the subject data. It is actually a strict application of the principle of necessity already contained in the principle of purpose itself.

Finally, article 25 in its paragraph 3 provides in fine that controller may use a certification mechanism approved in accordance with article 42 in order to demonstrate compliance with the aforementioned obligations.

The Directive

No provision of the Directive specifically covers the protection of data by design and the protection of data by default.

Potential issues

Two new obligations for data protection by design and default will pose difficulties in the implementation in that they involve consideration of the data protection at all levels of the process - and of all involved categories of said process of processing. They need to be properly implemented in close collaboration between the different position within the organization of the controller and awareness, or even a true knowledge of the principles involved: technical data processing staff (programmers, analysts, statisticians, etc.), staff related to the legal and compliance field and, as appropriate, other operational staff (marketing, etc.).

The task is even more difficult as we are facing delicate assessments (principles of necessity, taking into account the risk, etc.) which actually require  know-how and experience.

arrow_back Previous Article • Article 25 • Next Article arrow_forward
arrow_back Previous Article • Article 25 Next Article arrow_forward

Summary

European Union

European Union

European data protection board (EDPB)

Guidelines on Article 25 - 4/2019 (20 October 2020)

In an increasingly digital world, adherence to Data Protection by Design and by Default requirements plays a crucial part in promoting privacy and data protection in society. It is therefore essential that controllers take this responsibility seriously and implement the GDPR obligations when designing processing operations.

These Guidelines give general guidance on the obligation of Data Protection by Design and by Default (henceforth “DPbDD”) set forth in Article 25 in the GDPR. DPbDD is an obligation for all controllers, irrespective of size and varying complexity of processing. To be able to implement the requirements of DPbDD, it is crucial that the controller understands the data protection principles and the data subject’s rights and freedoms.

The core obligation is the implementation of appropriate measures and necessary safeguards that provide effective implementation of the data protection principles and, consequentially, data subjects’ rights and freedoms by design and by default. Article 25 prescribes both design and default elements that should be taken into account. Those elements, will be further elaborated in these Guidelines.

Article 25(1) stipulates that controllers should consider DPbDD early on when they plan a new processing operation. Controllers shall implement DPbDD before processing, and also continually at the time of processing, by regularly reviewing the effectiveness of the chosen measures and safeguards. DPbDD also applies to existing systems that are processing personal data.

The Guidelines also contain guidance on how to effectively implement the data protection principles in Article 5, listing key design and default elements as well as practical cases for illustration. The controller should consider the appropriateness of the suggested measures in the context of the particular processing in question.

The EDPB provides recommendations on how controllers, processors and producers can cooperate to achieve DPbDD. It encourages the controllers in industry, processors, and producers to use DPbDD as a means to achieve a competitive advantage when marketing their products towards controllers and data subjects. It also encourages all controllers to make use of certifications and codes of conduct.

Link

Guidelines on processing of personal data through blockchain technologies - 02/2025 (07 July 2026)

These guidelines provide a framework for organisations considering the use of blockchain technology, outlining key GDPR compliance considerations for planned processing activities. They provide an overview of the fundamental principles of blockchain technology, assessing the different possible architectures and their implications for the processing of personal data. Furthermore, they clarify that roles and responsibilites of different actors in a blockchain related processing need to be assessed during the design of that processing and what elements need to be considered in this respect. 

Link

Retour au sommaire
arrow_back Previous Article • Article 25 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-492/23 (2 December 2025) Russmedia Digital et Inform Media Press

On those grounds, the Court (Grand Chamber) hereby rules:

1.      Article 5(2) and Articles 24 to 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required, before the publication of the advertisements and by means of appropriate technical and organisational measures,

–        to identify the advertisements that contain sensitive data in terms of Article 9(1) of that regulation,

–        to verify whether the user advertiser preparing to place such an advertisement is the person whose sensitive data appear in that advertisement and, if this is not the case,

–        to refuse publication of that advertisement, unless that user advertiser can demonstrate that the data subject has given his or her explicit consent to the data in question being published on that online marketplace, within the meaning of Article 9(2)(a), or that one of the other exceptions provided for in Article 9(2)(b) to (j) is satisfied.

2.      Article 32 of Regulation 2016/679

must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required to implement appropriate technical and organisational security measures in order to prevent advertisements published there and containing sensitive data, in terms of Article 9(1) of that regulation, from being copied and unlawfully published on other websites.

3.      Article 1(5)(b) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), and Article 2(4) of Regulation 2016/679,

must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of Regulation 2016/679, of the personal data contained in advertisements published on its online marketplace, cannot rely, in respect of an infringement of the obligations arising from Article 5(2) and Articles 24 to 26 and 32 of that regulation, on Articles 12 to 15 of that directive, relating to the liability of intermediary providers.

Decision of the Court 
Opinion of Advocate General 

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 25 Next Article arrow_forward
Regulation
1e 2e

Art. 25

1.   Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.

2.   The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

3.   An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article.
1st proposal close

Art. 23

1.           Having regard to the state of the art and the cost of implementation, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

2.           The controller shall implement mechanisms for ensuring that, by default, only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes, both in terms of the amount of the data and the time of their storage. In particular, those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals.

3.           The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying any further criteria and requirements for appropriate measures and mechanisms referred to in paragraph 1 and 2, in particular for data protection by design requirements applicable across sectors, products and services.

4.           The Commission may lay down technical standards for the requirements laid down in paragraph 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2)
2nd proposal close

Art. 23

1. (...) Having regard to available technology and the cost of implementation and taking account of the nature, scope, context and purposes of the processing as well as the likelihood and severity of the risk for rights and freedoms of individuals posed by the processing, the controllers shall implement (...) technical and organisational measures appropriate to the processing activity being carried out and its objectives, such as data minimisation and pseudonymisation, in such a way that the processing will meet the requirements of this Regulation and protect the rights of (...) data subjects.

2. The controller shall implement appropriate measures for ensuring that, by default, only (...) personal data (...) which are necessary for each specific purpose of the processing are processed; this applies to the amount of (...) data collected, the extent of their processing, the period of their storage and their accessibility. Where the purpose of the processing is not intended to provide the public with information, those mechanisms shall ensure that by default personal data are not made accessible without human intervention to an indefinite number of individuals.

2a. An approved certification mechanism pursuant to Article 39 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2.

3. (…)

4. (…)
Directive close

No specific provision
Ukraine
compare_arrows

Serbia close

Article 42

Safeguards

Taking into account the state of the art and the costs of implementation, as well as the nature, scope, circumstances and purposes of the processing, and the likelihood and severity of risks to the rights and freedoms of natural persons resulting from processing, the controller shall, both at the time of the determination of the means for processing and during the processing itself:

1.         implement appropriate technical, organisational and personnel measures, such as pseudonymisation, designed to ensure effective implementation of personal data protection principles, such as data minimisation;

2.         implement the necessary safeguards into the processing in order to meet the requirements of this Law and protect the rights and freedoms of data subjects.

The controller shall be obliged, through the continuous application of appropriate technical, organisational and personnel measures, to ensure that only personal data which are necessary for achieving each specific purpose of processing are processed at all times. This obligation shall apply in relation to the amount of data collected, the extent of their processing, the period of their storage and their accessibility.

The measures referred to in paragraph 2 of this Article must always ensure that, without the involvement of a natural person, personal data cannot be made accessible to an unlimited number of natural persons.

The controller may use a certificate issued in accordance with Article 61 of this Law to demonstrate compliance with the obligations referred to in paragraphs 1 to 3 of this Article.

 

 

 
arrow_back Previous Article • Article 25 Next Article arrow_forward
close

2016 - www.itiplaw.eu.