Privacy by Default
What is Privacy by Default?
The principle that systems should be designed to automatically apply the strongest privacy settings without requiring user intervention.
Terms that appear alongside privacy by default
Each of these is named in at least one of the same controls as privacy by default. The number is how many controls name both.
- privacy by design 11 shared controls
- gdpr 8 shared controls
- data protection 7 shared controls
- accountability 6 shared controls
- sub processor 4 shared controls
- profiling 4 shared controls
- compliance 4 shared controls
- governance 4 shared controls
Frameworks that govern privacy by default
What the standards actually require on privacy by default
Requirements naming privacy by default across 6 standards, quoted from the control text.
Standard 3 per Section 21 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be adequate + relevant + and necessary in relation to the purposes for which they are processed (Data Minimisation Principle).
JM-DPA2020-Standard3-Adequacy-Relevance-Necessity-Sec21-Data-Minimisation-No-Excess-Processing · Jamaica DPA 2020 Standard 3 - Adequacy + Relevance + Necessity + Section 21 + Data Minimisation + No Excess Processing + Proportionality + Privacy by Default + Field-Level Restraint + Granular Permissions →Control: Stakeholders in an IoT system make sure the most protective privacy settings apply by default, with no action or intervention needed from the user. Purpose: Protecting personal information without relying on the user to act.
iso-iec-27400-2022::7.2.2-02 · 7.2.2-02 IoT privacy by default →Security Dimension 8 Privacy per X.805 Clause 6.8: Privacy shields what could be inferred by watching activity on the network, for example websites visited by users + their geographic location + the IP addresses and DNS names assigned to devices inside a provi...
X805-Dim8-Privacy-Identification-Network-Activity-Personal-Information-Confidentiality · ITU-T X.805 Security Dimension 8 - Privacy + Identification of Network Activity + Personal Information Confidentiality + Subscriber Anonymity + Pseudonymity + Anti-Tracking + Location Privacy + Data Minimization + GDPR/CCPA Alignment →Cote dIvoire Law 2013-450 Articles 55-77 + Decree 2017-740 governance + enforcement framework. Article 55 Data Protection Officer (DPO - Delegue a la Protection des Donnees) - mandatory for: (a) public bodies; (b) large-scale sensitive data processors;
CI-DPL-DPO-ROPA-ARTCI-Inspection-Sanctions-Marketing-Cookies-Articles-55-77-Convention-108-Modernisation · Cote dIvoire Law 2013-450 DPO + ROPA + ARTCI + Sanctions + Marketing + Modernisation →The controller and, where applicable, the processor must adopt appropriate measures, including privacy by design, privacy by default, data protection impact assessment and appointment of a data protection officer among others, to ensure adequate processing and...
paraguay-law-no-7593-2025-on-personal-data-protection::4(h) · Article 4(h) Due diligence →Deliver the greatest degree of privacy by making personal data automatically protected in every IT system and business practice, so that an individual who does nothing keeps their privacy intact and needs to take no action to protect it.
privacy-by-design-pbd-seven-foundational-principles::2 · Principle 2: Privacy as the Default Setting →Questions people ask about privacy by default
What is Privacy by Default?
Why is Privacy by Default important for compliance?
Which compliance frameworks address Privacy by Default?
Where can I learn more about Privacy by Default?
See how Privacy by Default applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.