Data Protection by Design
What is Data Protection by Design?
The principle of integrating data protection measures into the design and development of business processes and IT systems from the outset. Required under GDPR Article 25 and considered best practice across all privacy regulations.
Terms that appear alongside data protection by design
Each of these is named in at least one of the same controls as data protection by design. The number is how many controls name both.
- data protection 19 shared controls
- gdpr 6 shared controls
- data minimisation 5 shared controls
- privacy by design 4 shared controls
- confidentiality 4 shared controls
- impact assessment 4 shared controls
- records of processing activities 4 shared controls
- data protection impact assessment 4 shared controls
Frameworks that govern data protection by design
What the standards actually require on data protection by design
Requirements naming data protection by design across 6 standards, quoted from the control text.
Both when designing processing tools and during processing, the controller must implement appropriate technical and organisational measures, such as pseudonymisation, that give effect to the principles (data minimisation in particular) and build the needed saf...
albania-law-no-124-2024-on-personal-data-protection::23 · Article 23: data protection by design and by default →Data Protection by Design and by Default (GDPR Article 25) requires that, at the time of determining the means for processing and at the time of the processing itself, the controller implements appropriate technical and organisational measures designed to impl...
ENISA-DPE-1.1 · Data Protection by Design →Data protection must be built in from the earliest planning, especially for intrusive systems such as ANPR, body worn video and facial recognition.
uk-ico-guidance-on-video-surveillance-including-cctv-2022::A.3 · A.3 Data protection by design: buy for a compliant solution, set procurement criteria, and make data easy to locate and extract →Employers must build data protection in by design and by default; where they issue devices that involve tracking technology, they should choose the most privacy-friendly option and take data minimisation into account.
article-29-working-party-opinion-2-2017-on-data-processing-at-work-wp249::3.2.1 · 3.2.1 Data protection by design and default in monitoring devices and tools →Design security into systems, products and business practices from the outset rather than adding it afterwards, following recognised practice.
CCM-DSP-07 · Data Protection by Design and Default →Systems, products and business practices are developed around the principle of building security in from the start, following recognised industry practice.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::DSP-07 · Data Protection by Design and Default →Questions people ask about data protection by design
What is Data Protection by Design?
Why is Data Protection by Design important for compliance?
Which compliance frameworks address Data Protection by Design?
Where can I learn more about Data Protection by Design?
See how Data Protection by Design applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.