What is Privacy by Design?

The concept was articulated by Dr. Ann Cavoukian, then Ontario's Information and Privacy Commissioner, in the 1990s as seven foundational principles: proactive not reactive; privacy as the default setting; privacy embedded into design; full functionality (positive-sum, not privacy-versus-features); end-to-end security; visibility and transparency; and respect for user privacy. What began as a policy framework became binding law when GDPR Article 25 required controllers to implement appropriate technical and organizational measures designed to implement the data protection principles, both at the time processing means are determined and during the processing itself.

Article 25's second half — data protection by default — is the operational sharp edge: by default, only personal data necessary for each specific purpose may be processed, in amount, extent of processing, storage period, and accessibility. Defaults decide real-world outcomes because most users never change them; a product whose default shares everything has made the privacy decision for its users, and under GDPR it has made it unlawfully.

In engineering practice, privacy by design shows up as requirements: privacy review in the design phase rather than pre-launch sign-off, minimization built into schemas and event payloads, retention and deletion implemented as code paths rather than policies, pseudonymization where identity is unnecessary, and consent state propagated through every system that acts on user data. DPIAs are the documented instance of the discipline for risky processing.

Regulators cite Article 25 as an aggravating or independent violation when investigations reveal architectures that made compliance impossible — systems with no deletion capability being the recurring example.