Obligations & assessments
Data protection by design and by default
DPbD · PbD
GDPRGDPR Art. 25
Controllers must build data protection into processing from the design stage, with measures such as pseudonymisation and minimisation, and make the most privacy-friendly option the default so only the personal data needed for each purpose is processed.