Privacy by Design e by Default: GDPR Article 25 Explained

If you have researched General Data Protection Regulation (GDPR) compliance, you have probably run into the phrase privacy by design e by default. It is the Italian rendering of "privacy by design and by default," the twin obligations set out in Article 25 of the GDPR, and the concept is identical in every EU member state. This guide explains what both principles require, how regulators enforce them, and the practical steps you can take to comply. The content here is educational rather than legal advice, so consult a qualified attorney for guidance specific to your business.

What Privacy by Design e by Default Means

Privacy by design e by default is a single legal obligation with two parts, defined in Article 25 of the GDPR. Privacy by design (Article 25(1)) requires organizations to build data protection into their products, services, and internal processes from the earliest design stage. Privacy by default (Article 25(2)) requires that, once a system is live, the most privacy-protective settings apply automatically.

The phrase appears with the Italian "e" (meaning "and") because Italy's data protection authority, the Garante per la Protezione dei Dati Personali, and Italian compliance literature use the English terms joined by the Italian conjunction. Whether you read it in Italian, English, or any other EU language, the legal requirement is the same regulation: EU Regulation 2016/679.

A useful shorthand: design is about how you build, default is about how it behaves out of the box. A signup form that only asks for an email address reflects design. A newsletter checkbox that starts unticked reflects default.

The Legal Basis: GDPR Article 25

Article 25 addresses data controllers, meaning any organization that decides why and how personal data is processed. That includes a one-person e-commerce store just as much as a multinational SaaS company.

Article 25(1) requires controllers to implement "appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner." Three factors shape what counts as appropriate:

• The state of the art: what protective technology is currently available.
• The cost of implementation: measures must be proportionate, not ruinous.
• The nature, scope, context, and purposes of processing, weighed against the risks to individuals.

Article 25(2) then requires that "by default, only personal data which are necessary for each specific purpose of the processing are processed." That covers the amount of data collected, the extent of processing, the storage period, and accessibility. It explicitly states that personal data must not be made accessible to an indefinite number of people without the individual's intervention.

The European Data Protection Board (EDPB) expanded on both duties in Guidelines 4/2019 on Article 25, which stress that measures must be effective in practice, not just documented on paper.

The Seven Foundational Principles of Privacy by Design

The concept predates the GDPR. Dr. Ann Cavoukian, then Information and Privacy Commissioner of Ontario, formulated seven foundational principles in the 1990s, and Article 25 turned the philosophy into binding law. The original principles still provide the clearest mental model:

1. Proactive, not reactive: anticipate privacy risks before they materialize instead of responding to breaches.
2. Privacy as the default setting: no action required from the individual to be protected.
3. Privacy embedded into design: safeguards are part of the architecture, not bolted on later.
4. Full functionality: privacy and business goals coexist; it is not a zero-sum trade-off.
5. End-to-end security: data is protected across its entire lifecycle, from collection to deletion.
6. Visibility and transparency: practices are open to users and verifiable by regulators.
7. Respect for user privacy: interfaces and options are user-centric, with strong defaults and clear choices.

For a deeper look at the design half of the obligation, see the dedicated guide on privacy by design.

Privacy by Default: What It Requires in Practice

Privacy by default is the half that trips up most websites, because it governs concrete product decisions rather than abstract architecture. Under Article 25(2), the default state of your system must minimize processing across four dimensions:

• Amount of data collected: forms request only fields that are necessary for the stated purpose.
• Extent of processing: data collected for order fulfillment is not silently reused for profiling.
• Storage period: data is deleted or anonymized once the purpose is fulfilled, on a defined schedule.
• Accessibility: profiles, posts, and personal details are not public by default.

Concrete examples of compliant defaults:

• Marketing checkboxes start unticked. The Court of Justice of the EU confirmed in Planet49 (C-673/17) that pre-ticked boxes cannot produce valid consent.
• Non-essential cookies stay off until the visitor opts in through a consent banner, as required by Article 5(3) of the ePrivacy Directive alongside the GDPR.
• New social or community accounts default to the most restrictive visibility setting.
• Optional analytics, personalization, and data sharing features require an active opt-in.

The companion article on privacy by default covers these settings-level requirements in more detail.

How to Implement Privacy by Design e by Default

Implementing privacy by design e by default is a process, not a one-time project. The following sequence works for most websites and apps.

Step 1: Map Your Data

You cannot minimize what you have not inventoried. List every category of personal data you collect, where it enters your systems, which third parties receive it, and how long you keep it. For many organizations this doubles as the Article 30 record of processing activities.

Step 2: Run a DPIA Where Risk Is High

Article 35 of the GDPR requires a Data Protection Impact Assessment (DPIA) before processing that is "likely to result in a high risk," such as large-scale profiling or systematic monitoring. Even where a DPIA is not mandatory, a lightweight risk assessment at the design stage is the cheapest moment to catch problems.

Step 3: Minimize at the Point of Collection

Review every form and API. Delete fields you cannot tie to a specific purpose. A checkout page needs a shipping address; it rarely needs a date of birth.

Step 4: Set Protective Defaults

Apply the defaults listed in the previous section: unticked boxes, opt-in cookies, restrictive visibility, and defined retention periods that actually execute (an automated deletion job, not a policy document nobody enforces).

Step 5: Apply Technical Safeguards

Article 25(1) names pseudonymization explicitly, and Article 32 adds encryption, confidentiality, integrity, and resilience. In practice that means TLS everywhere, encryption at rest for sensitive stores, role-based access control, and pseudonymized identifiers in analytics.

Step 6: Document and Disclose

Regulators expect evidence. Keep dated records of design decisions, DPIAs, and default configurations. Then make sure your public documents match reality: your privacy policy must accurately describe what you collect, why, for how long, and with whom you share it. A policy that promises minimization while your site sets 20 tracking cookies before consent is itself evidence of non-compliance.

Penalties and Enforcement for Article 25 Violations

Violating privacy by design e by default carries fines of up to 10 million EUR or 2% of total worldwide annual turnover, whichever is higher, under Article 83(4)(a) of the GDPR. In practice, Article 25 violations rarely appear alone; they usually accompany breaches of the Article 5 principles, which fall under the higher 20 million EUR or 4% tier of Article 83(5).

Real enforcement actions show how regulators apply the rules:

• Deutsche Wohnen (Germany, 2019): the Berlin data protection authority fined the housing company 14.5 million EUR for an archive system that made deleting tenant data impossible, a textbook failure of storage limitation by design.
• Oslo Municipality (Norway, 2020): the Norwegian DPA fined the city 1.2 million NOK over a school messaging app that let parents send children's health information through an unsecured channel, a failure to build adequate safeguards into the app's design.
• The Italian Garante has repeatedly cited privacy by design e by default in fines against energy and telecom companies for telemarketing systems that processed data of people who never consented.

The pattern across cases: regulators look at what the system actually did, not what the compliance binder said it should do.

Privacy by Design vs Privacy by Default: Side by Side

The two halves of Article 25 are complementary but distinct. This table summarizes the differences:

Aspect	Privacy by Design	Privacy by Default
GDPR provision	Article 25(1)	Article 25(2)
Focus	System architecture and process	Out-of-the-box settings and behavior
Timing	Before and during development	At and after launch
Example measure	Pseudonymized user IDs in analytics	Analytics cookies off until opt-in
Key question	"Did we build protection in?"	"Is the user protected without doing anything?"
Named techniques	Pseudonymization, minimization by architecture	Necessity limits on amount, extent, storage, access

If you satisfy design but not default, you fail Article 25. A beautifully encrypted database does not excuse a signup flow with pre-ticked marketing consent.

How Privacy by Design e by Default Shapes Your Legal Documents

Article 25 governs systems, but it has direct consequences for your website's legal pages and consent tooling. Three connections matter most.

First, your privacy policy is the transparency layer over your design decisions. Articles 13 and 14 require you to disclose purposes, legal bases, retention periods, and recipients, which you can only state accurately after doing the data mapping described above. A privacy policy generator that builds the document from your actual data practices keeps the two aligned.

Second, cookie consent is where privacy by default becomes visible to every visitor. Your consent banner must block non-essential cookies until opt-in, and your cookie policy must list what runs after consent. Automated compliance platforms such as TermsBox pair a scanner with a consent banner so that the documented cookie list matches what the site actually sets, which is exactly the design-matches-reality standard regulators test.

Third, defaults must survive change. Every new marketing pixel, plugin, or vendor can silently break a previously compliant default. Schedule periodic rescans of your site, and update your disclosures whenever processing changes, as the GDPR compliance checklist recommends for ongoing audits.

Frequently Asked Questions

What does privacy by design e by default mean?

Privacy by design e by default is the Italian phrasing of the twin obligations in Article 25 of the GDPR. Privacy by design requires you to build data protection into systems from the start, while privacy by default requires that the most privacy-protective settings apply automatically without user action.

Is privacy by design legally required or just best practice?

It is legally required for any organization subject to the GDPR. Article 25 makes data protection by design and by default a binding obligation for data controllers, and violations can be fined up to 10 million EUR or 2% of global annual turnover under Article 83(4).

What is the difference between privacy by design and privacy by default?

Privacy by design covers how you build systems: embedding safeguards like pseudonymization and data minimization into the architecture itself. Privacy by default covers how systems behave out of the box: only necessary data is processed, and the strictest privacy settings apply unless the user actively changes them.

Does privacy by design apply to small businesses?

Yes. Article 25 applies to every data controller processing personal data of people in the EU, regardless of company size. The GDPR does allow you to take the cost of implementation and the risk level into account, so a small website needs proportionate measures, not enterprise-grade infrastructure.

How do I show compliance with privacy by design e by default?

Document your decisions: keep records of Data Protection Impact Assessments, data minimization choices, default settings, and retention schedules. Your public-facing privacy policy should then accurately reflect these practices, since regulators compare stated policies against actual system behavior.

Can pre-ticked consent boxes violate privacy by default?

Yes. Pre-ticked boxes for marketing, cookies, or data sharing directly contradict Article 25(2), which requires that data is not made accessible or processed by default without the individual's intervention. The CJEU confirmed in the Planet49 case (C-673/17) that pre-ticked boxes cannot produce valid consent.