- Article 25 of the GDPR asks for data protection by design and by default.
- By design: the data protection principles are built in when you decide how the product works (Article 25(1)).
- By default: only the personal data each purpose needs, in what you collect, keep and show (Article 25(2)).
The GDPR is Regulation (EU) 2016/679 of 27 April 2016, on the protection of natural persons with regard to the processing of personal data. Most of it reads like a rulebook for lawyers. Article 25 reads like a brief for a product team.
This is not legal advice, and nothing here tells you whether your product meets the law. That call belongs to you and your advisers. What follows is what the text says, in plain terms, linked so you can read it yourself.
Who the article speaks to
It speaks to the controller. Article 4(7) defines the controller as the person or body that, alone or jointly with others, determines the purposes and means of processing personal data. If your company decides why your product handles personal data and how, that is usually you.
If you build software that other organisations use to handle their own customers’ data, the text still reaches you. Recital 78 says producers of products, services and applications should be encouraged to take the right to data protection into account when they develop and design them. The European Data Protection Board’s Guidelines 4/2019 on Article 25 describe such producers as key enablers of data protection by design and by default.
By design: decide it before you build it
Article 25(1) asks the controller to put in place appropriate technical and organisational measures, both when the means of processing are decided and during the processing itself. The measures are designed to put the data protection principles into effect, and to build in the safeguards the Regulation needs. It names pseudonymisation and data minimisation as examples.
The article weighs what is appropriate against the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risks it poses to people’s rights and freedoms.
For a product leader, that means the question arrives at the design review, not after launch. When a new feature asks for a field, a log or an export, the moment to ask whether it needs personal data is before anyone builds it.
By default: the product as it ships
Article 25(2) asks for measures ensuring that, by default, only the personal data necessary for each specific purpose are processed. It applies that to four things: the amount collected, the extent of processing, the period of storage and accessibility. It adds that, by default, personal data must not be made accessible to an indefinite number of people without the individual’s intervention.
The EDPB guidelines read “by default” as the settings a product comes with: the values that are preset before anyone changes them. That is squarely a product decision.
As product questions, the four are plain.
What to collect. Which fields does each purpose actually need? A form that asks for less has less to protect.
What to do with it. Is data gathered for one purpose quietly reused for another? Each purpose earns its own answer.
What to keep. How long does each kind of record need to live, and what happens to it afterwards?
Who can see it. Which roles inside your company and your customer’s need access, and who sees a profile when it is created? Start narrow and let people open it up.
None of this needs to crowd the roadmap. Answer the four questions once per feature, and you can lift your eyes back to the product your customers rely on.
Where we come in
We give no legal advice and make no compliance promise. Whether your product meets Article 25 is for you and your advisers to judge.
What we can do is the security work on your product that you choose, described in Harden security before the questionnaire arrives. The work lands in your own code repository. The code we build for you is yours. You decide what ships. Nothing reaches your users without your approval.
It starts with a conversation, with no obligation.
