We buy software and build nothing ourselves. Does Article 25 still apply to us?

Yes. Paragraph 1 places the obligation on the controller at the time the means of processing are determined, and choosing software is such a moment. Recital 78 says producers should be encouraged to build data protection into their products, but the obligation stays with you: when selecting and using the application you must check whether its built-in measures and settings allow you to meet the GDPR.

What is the difference between 'by design' and 'by default'?

By design (paragraph 1) concerns the measures you build in when determining the means and during the processing, such as pseudonymisation, so that the GDPR principles are put into practice. By default (paragraph 2) concerns the settings as they stand when nobody changes anything: by default only the data necessary for the specific purpose are processed, in terms of amount, extent of processing, storage period and accessibility. The first is about how the system is built, the second about how it works out of the box.

Our app lets users share their profile. What does Article 25 ask of us there?

Paragraph 2 says that by default personal data must not be made accessible to an indefinite number of people without the individual's intervention. Sharing a profile with everyone must therefore be a deliberate action by the user, and the default setting must be restricted. Recital 78 adds transparency about what happens to the data and the ability for the data subject to keep control over it.

Article 25: Data protection by design and by defaultAI-relevant

Praxikon tracks Article 25 (Data protection by design and by default) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 25 requires the controller to build data protection into a system or process from the start, rather than adding it afterwards. Already when determining the means, that is when designing or selecting for example software or an AI model, and also during the processing itself, you implement appropriate measures, such as pseudonymisation, that put the GDPR principles such as data minimisation into practice (paragraph 1). In addition, the default settings must ensure that only the data necessary for each specific purpose are processed: this covers the amount of data, the extent of processing, the storage period and accessibility (paragraph 2). By default, personal data must not be made accessible to an indefinite number of people without the individual's own intervention (paragraph 2). The article exists because you must be able to demonstrate compliance with the GDPR, and for that purpose internal policies and measures belong in the design and default settings themselves, such as data minimisation and pseudonymising data as soon as possible (recital 78).

Key term: Data protection by design and by default: privacy protection is built into the system itself, and the most restrictive setting is the default

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Data protection by design complements AI Act requirements for accuracy and cybersecurity (Art. 15). Both require built-in protection.

AI Act Art. 15 →

Official text

Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.

The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Take data protection into account at the moment you design or procure a system, service or working method, not only once it is already running (paragraph 1). Choose measures such as pseudonymisation and data minimisation, weighing the state of the art, the cost of implementation and the risk to data subjects (paragraph 1). Set defaults so that, for each purpose, only the necessary data are collected, processed, stored and made accessible, and so that data are not visible to an indefinite number of people by default (paragraph 2).

Data Subject

You can expect a service to process by default only the data necessary for its purpose, and to not make your data visible to an indefinite number of people without your own action (paragraph 2).

Compliance checklist

For the design or procurement of every new system or process, it is recorded which data protection measures are built in before processing starts (paragraph 1).The choice of measures, such as pseudonymisation, is justified with reference to the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing and the risk to data subjects (paragraph 1, recital 78).For each purpose it is recorded which personal data are necessary, and by default only those data are collected (paragraph 2).Default settings also limit the extent of processing, the storage period and who has access (paragraph 2).By default, personal data are not accessible to an indefinite number of people without the individual's own action, for example through a public profile (paragraph 2).The data subject can see what the system does with their personal data and, where possible, has control over it (recital 78).In public tenders and supplier selection, the principles of data protection by design and by default have been taken into account (recital 78).If an approved certification mechanism under Article 42 is used, this is recorded as an element to demonstrate compliance with paragraphs 1 and 2 (paragraph 3).

Related recitals

(78)

The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the r...

Cross-references

Art. 42: Certification

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Guidelines (2)

14 February 2023 · v2.0 · EDPB
Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them
Describes types of deceptive design patterns in social media interfaces and how they conflict with the GDPR, with practical recommendations for designers.
9 March 2021 · v2.0 · EDPB
Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications
Addresses data protection for connected vehicles and mobility apps, such as location data, biometrics and access to data stored in the vehicle.

Fines (3)

12 December 2024 · Data Protection Commission (Ireland)€251,000,000
Meta: data breach via the 'View As' feature
Through a Facebook vulnerability, unauthorised persons gained access to about 29 million accounts in 2018, around 3 million of them in the EU. Meta's breach notification was incomplete, its documentation was inadequate, and data protection was not built into design and default settings.
Two decisions of 12 December 2024, announced on 17 December 2024. Meta announced an appeal; whether one was lodged has not been verified.
1 September 2023 · Data Protection Commission (Ireland)€345,000,000
TikTok: children's accounts public by default
Children's accounts were public by default and the Family Pairing feature was poorly safeguarded, while children were not properly informed. At the EDPB's direction, deceptive design choices were also found to breach the fairness principle.
Decision of 1 September 2023, announced on 15 September 2023. TikTok challenged the decision before the EU General Court (case T-1030/23) and the Irish High Court.
2 September 2022 · Data Protection Commission (Ireland)€405,000,000
Instagram: children's data public by default
Children aged 13 to 17 could run business accounts that published their email address or phone number, and children's personal accounts were public by default. At the EDPB's direction, an infringement of the legal basis for processing was also found.
Decision of 2 September 2022, announced on 15 September 2022. Meta appealed to the Irish High Court.

Checked on 1 October 2026

Frequently asked questions

← Art. 24: Responsibility of the controller Art. 26: Joint controllers →

Connections

Themes where this returns

Privacy by design and risk management by design

The counterpart in the other law

Case law

Russmedia: an online marketplace operator is controller for personal data in adverts and must check before publication
2025-12-02 · final, Hof van Justitie van de EU (Grote kamer), X tegen Russmedia Digital SRL en Inform Media Press SRL

Guidelines

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default
2020-10-20 · final, European Data Protection Board (EDPB)
Guidelines 02/2025 on processing of personal data through blockchain technologies
2026-07-07 · final, European Data Protection Board (EDPB)
Guidelines 01/2025 on Pseudonymisation
2025-01-16 · adopted, European Data Protection Board (EDPB)

Legislation in motion

Council: Cyprus Presidency tables negotiating mandate, Coreper vote of 26 June 2026 cancelled
2026-06-22 · under negotiation, Raad van de Europese Unie, Antici-groep (vereenvoudiging) en Coreper