Set by the law · GDPR Art. 25(1)
Data protection by design and by default
In plain English
Controllers must build data protection into their systems from the design stage, and set defaults so that only the personal data needed for each specific purpose are processed.
The official text
the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.
307 decisions on Fino cite Article 25 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.