Privacy by design
An approach that builds the protection of personal data into a product or service from the start, instead of adding it at the end, and makes the most private option the default.
What it’s for
It keeps privacy from being reduced to a notice or a permission at the end, when the data is already being collected and shared for no reason.
Principles
Prevent, don't remedy
Risks are anticipated before any harm happens.
Private by default
People don't have to do anything to be protected.
Give up nothing
Privacy and functionality are pursued together, not one at the expense of the other.
How it’s done
Ask what data is really needed and what for.
Design with the minimum, and with the most private option already selected.
Protect the data throughout the life of the service, until it is deleted.
Applications in design
When to use it
In any product that collects personal data, such as forms, accounts, apps, sensors or systems with artificial intelligence.
Avoid
Asking for data “just in case” or leaving the sharing boxes ticked.
Don’t fall for it
A long privacy notice is no substitute for a design that collects less data.
Connections
Authors and works
- 2009
Ann Cavoukian
As Information and Privacy Commissioner of Ontario (Canada), she set out seven foundational principles, which she revised in 2011.
- 2016
European Union
Article 25 of the General Data Protection Regulation made data protection by design and by default a legal obligation.
- 2020
European Data Protection Board
Its guidelines explain that “by default” covers how much data is collected, how far it is processed, how long it is kept and who can see it.
Sources
Original sources
- Cavoukian, A. (2009, revisado en 2011). Privacy by design: The 7 foundational principles. Information and Privacy Commissioner of Ontario.
- Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de April 27, 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales (Reglamento general de protección de datos). Diario Oficial de la Unión Europea, L 119, May 4, 2016. View source: Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de April 27, 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales (Reglamento general de protección de datos)
Secondary sources
- Comité Europeo de Protección de Datos (2020). Directrices 4/2019 relativas al artículo 25: Protección de datos desde el diseño y por defecto (versión 2.0, adoptada el October 20, 2020). View source: Comité Europeo de Protección de Datos (2020)
Last reviewed: