Data protection by design and by default is the legal obligation, set out in Article 25 of the General Data Protection Regulation (GDPR), for an organisation that decides how personal data is used to build safeguards into that processing from the moment it is planned, and to configure every system so that, without any action by the individual, only the data needed for each specific purpose is processed. It exists because principles such as data minimisation mean little if systems are built to ignore them. Article 25 turns those principles into an engineering requirement, enforceable with fines.

The phrase is often used as a synonym for privacy by design, Ann Cavoukian's seven voluntary principles, covered in PPC Land's companion explainer. Privacy by design is a philosophy; Article 25 is a statutory duty with a defined addressee and penalty ceiling.

What Article 25 actually requires

Article 25(1), by design. The controller must, "both at the time of the determination of the means for processing and at the time of the processing itself", implement "appropriate technical and organisational measures, such as pseudonymisation", designed to implement the data protection principles "in an effective manner". What counts as appropriate is weighed against four factors: the state of the art, the cost of implementation, the nature, scope, context and purposes of processing, and the risks to individuals.

Article 25(2), by default. The controller must ensure that "by default, only personal data which are necessary for each specific purpose of the processing are processed". The obligation covers four dimensions: the amount of data collected, the extent of processing, the period of storage, and accessibility. By default, personal data must not be "made accessible without the individual's intervention to an indefinite number of natural persons".

Article 25(3), certification. An approved certification under Article 42 "may be used as an element to demonstrate compliance". It is evidence, not immunity.

The duty falls on the controller, the entity that determines the purposes and means of processing. Recital 78 says only that producers of products and applications "should be encouraged" to consider data protection, a gap EU legislators are, as of November 2026, trying to close.

How regulators read it: Guidelines 4/2019

The European Data Protection Board (EDPB), the body of EU national regulators, adopted Guidelines 4/2019 on Article 25 for public consultation on November 13, 2019 and in final form, version 2.0, on October 20, 2020. Five points shape how the duty works in practice.

  • Effectiveness over form. "Effectiveness is at the heart of the concept of data protection by design," according to the guidelines. Article 25 "does not require the implementation of any specific technical and organizational measures". Controllers choose measures and must show they work, through key performance indicators (KPIs), such as a fall in complaints, or a documented rationale.
  • State of the art moves. It "is a dynamic concept that cannot be statically defined at a fixed point in time."
  • Cost is a factor, not an excuse. Cost is "a factor to be considered to implement data protection by design rather than a ground to not implement it".
  • Timing starts at procurement. The design stage includes "the time of procuring and implementing data processing software, hardware, and services". The duty continues while processing runs, including on legacy systems.
  • Processors are the controller's problem. "The controller is responsible for the fulfilment of the DPbDD obligations for the processing carried out by their processors and sub-processors," the guidelines state.

Under fairness, a search engine example states that a consent request for targeted advertising should offer "two equally visible choices", and that dark patterns "are contrary to the spirit of Article 25".

The four default dimensions in an advertising setting

Amount collected. The EDPB's own worked example is an online bookshop whose checkout makes date of birth and phone number mandatory. Neither is needed to sell a book.

Extent of processing. Data collected to fulfil an order should not, by default, flow into audience segments or lookalike modelling. Reuse needs its own legal basis.

Storage period. The guidelines say data "shall by default be deleted or anonymized" once no longer needed. Bid logs and identity graphs need retention schedules set in the system, not in a policy document.

Accessibility. Profiles, posts and contact details should not be public, searchable or shared with partners until the individual chooses. This dimension sits behind the largest fines.

Origin and evolution

Recital 46 of the 1995 Data Protection Directive already asked for security measures at the design stage, though only for security. The European Commission's GDPR proposal of January 25, 2012 placed "data protection by design and by default" in what was then Article 23 and extended it to every principle. The regulation was adopted on April 27, 2016 and has applied since May 25, 2018. The UK kept it in the UK GDPR after Brexit.

The UK went further on February 5, 2026, when section 81 of the Data (Use and Access) Act 2025 came into force. It adds paragraphs 1A and 1B to UK GDPR Article 25: providers of information society services "likely to be accessed by children" must take into account "the children's higher protection matters". The Information Commissioner's Office (ICO) had applied similar thinking through its Age Appropriate Design Code since September 2, 2021. Germany's regulators have asked for the same in EU law: their November 20, 2025 resolution proposed amending Article 25 so that defaults take "particular account of the vulnerability of children".

Fines and enforcement

Article 25 breaches sit in the lower fine tier of Article 83(4): up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. They also count twice. Under Article 83(2)(d), regulators setting any fine must consider "the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32".

Ireland's Data Protection Commission (DPC) has produced the largest Article 25 penalties. It fined Meta EUR 265 million on November 25, 2022 over data scraping under Articles 25(1) and 25(2). TikTok's EUR 345 million fine in September 2023 included public-by-default child accounts. On December 17, 2024 it fined Meta EUR 251 million, of which EUR 130 million was under Article 25(1) and EUR 110 million under Article 25(2). Graham Doyle, the DPC's deputy commissioner, cited "the failure to build in data protection requirements throughout the design and development cycle".

Smaller cases reach beyond social media. France's regulator, the Commission nationale de l'informatique et des libertés (CNIL), fined IQVIA EUR 5 million in a decision adopted on May 26, 2026, finding an Article 25 breach because pharmacy software kept extracting patient data where pharmacists had refused transmission. Poland's regulator cited Article 25(1) when it fined McDonald's Polska about EUR 3.89 million in July 2025 over a processor-run scheduling system.

Why it matters for marketers

For advertising, Article 25 converts product settings into legal evidence. A tracking feature switched on at launch or a consent screen with a bright "accept" and a grey "settings" link is a design decision a regulator can examine directly. PPC Land's reporting on Meta's localhost tracking on Android in June 2025 and on an investigation of LG televisions mapping home networks in September 2026 both framed the practices as Article 25 questions. Because controllers answer for their processors, the burden also runs to the tags and SDKs they install.

Limitations and disputes

The most persistent criticism is inconsistency. A Future of Privacy Forum report published on May 17, 2023 analysed more than 92 decisions, rulings and guidance documents from 16 European Economic Area states, the UK and the EDPB. It found that regulators "diverge in how they interpret the preventive nature of Article 25", and that most are "reluctant to specify appropriate protective measures". Enforcement choices are disputed too. When the DPC fined Google EUR 403 million over location data on September 21, 2026, PPC Land noted that the announcement did not mention Article 25, the provision complainants had invoked over Web & App Activity being switched on by default. Certification under Article 25(3) remains thin; the EDPB required 26 changes to one German scheme in July 2025.

How it differs from adjacent terms

  • Privacy by design is Cavoukian's broader seven-principle framework, voluntary outside the GDPR. Data protection by design and by default is the binding EU and UK legal version.
  • Security of processing under Article 32 covers confidentiality, integrity and availability. Article 25 covers every principle, including fairness, minimisation and storage limitation.
  • Data protection impact assessment (DPIA) under Article 35 is a documented risk analysis required for high-risk processing. Article 25 applies to all processing and requires the risks to be addressed in the build.
  • Data minimisation is a principle in Article 5(1)(c). Article 25 is the mechanism that obliges controllers to engineer it into systems.

Recent developments

In its Digital Omnibus negotiating mandate, agreed by EU ambassadors on October 21, 2026, the Council of the EU would extend data protection by design and by default to processors as well as controllers, "with particular regard to the lists referred to in Article 35(4) and (5)". If that survives talks with the European Parliament, which had no position as of late October 2026, vendors such as SDK providers and cloud platforms would carry the duty directly rather than through contracts.

The EDPB's October 13, 2026 statement on smart glasses said manufacturers cannot rely on wearers to meet GDPR duties, pressing on the same producer gap that Recital 78 left open in 2016.

Timeline

  • October 24, 1995 - Data Protection Directive adopted; Recital 46 asks for security measures at the design stage.
  • January 25, 2012 - European Commission proposes the GDPR, with data protection by design and by default in draft Article 23.
  • April 27, 2016 - GDPR adopted, including Article 25.
  • May 25, 2018 - GDPR applies.
  • November 13, 2019 - EDPB adopts Guidelines 4/2019 for consultation.
  • October 20, 2020 - Guidelines 4/2019 version 2.0 adopted.
  • September 2, 2021 - UK Age Appropriate Design Code fully in force.
  • November 25, 2022 - DPC fines Meta EUR 265 million under Articles 25(1) and 25(2).
  • February 2023 - EDPB publishes final Guidelines 03/2022 on deceptive design patterns.
  • May 17, 2023 - Future of Privacy Forum publishes its Article 25 enforcement report.
  • September 2023 - DPC fines TikTok EUR 345 million, including over public-by-default child accounts.
  • December 17, 2024 - DPC fines Meta EUR 251 million, EUR 240 million of it under Article 25.
  • July 2025 - Polish regulator fines McDonald's Polska, citing Article 25(1).
  • November 20, 2025 - German regulators propose child-focused amendments to Article 25.
  • February 5, 2026 - UK Data (Use and Access) Act section 81 adds children's higher protection matters to UK GDPR Article 25.
  • May 14, 2026 - Italy's Garante warns a Slack plug-in developer, citing Article 25.
  • May 26, 2026 - CNIL fines IQVIA EUR 5 million, including for an Article 25 breach.
  • September 21, 2026 - DPC fines Google EUR 403 million over location data without citing Article 25.
  • October 13, 2026 - EDPB statement on smart glasses.
  • October 21, 2026 - Council mandate on the Digital Omnibus would extend Article 25 to processors.

Summary

Who: Every data controller under the EU GDPR and UK GDPR, including publishers, advertisers, ad platforms and app developers, answerable for their processors' setups too; the EDPB, which interprets the duty; and national regulators such as the Irish DPC, the CNIL, the Garante and the ICO, which enforce it.

What: A legal obligation under GDPR Article 25 to build effective safeguards into processing from the design stage onward (by design) and to ensure that, without user action, only the personal data necessary for each purpose is collected, processed, stored and made accessible (by default).

When: Proposed in January 2012, binding since May 25, 2018, interpreted by EDPB guidelines finalised on October 20, 2020, extended for children in the UK from February 5, 2026, and under renegotiation in the EU Digital Omnibus as of November 2026.

Where: The European Economic Area under the GDPR and the UK under the UK GDPR, with influence on child-focused design codes and age-assurance rules elsewhere.

Why: Principles written into law are only as strong as the systems that apply them. Article 25 makes architecture and default settings themselves a matter of compliance, and it has carried some of the largest GDPR fines, including EUR 240 million of Meta's December 2024 penalty.