Privacy by default

Privacy by Default is one of the key principles of the General Data Protection Regulation (GDPR), mentioned in Article 25 alongside the concept of “Privacy by Design.” Privacy by Default, also referred to as “data protection by default,” requires data controllers to take all necessary measures to ensure that, by default, only data strictly necessary for each specific purpose is processed. The aim is to minimize the collection, use, and storage of unnecessary personal data.

In the context of Privacy by Default, the data controller must ensure that all settings and configurations of systems and applications are, by default, oriented towards protecting the personal data of data subjects. This means that the most privacy-intrusive options must be disabled by default, and data should only be processed when strictly necessary.

Examples of applying the principle of Privacy by Default include:

• Minimal data collection: Requesting only the data strictly necessary for the stated purpose, avoiding the collection of irrelevant or excessive information.
• High default privacy settings: In applications and online services, settings for sharing personal data should be configured to ensure maximum protection for the user, allowing changes only on a voluntary basis.
• Limited data access: Restricting access to personal data to only those who strictly need it to fulfill the purpose of the processing.

The principle of Privacy by Default must be applied at all stages of data processing, from collection to storage, and requires that the data controller documents the measures taken to ensure compliance with this principle. This is essential to demonstrate accountability, meaning the responsibility to ensure the protection of personal data.

Trust Guardian’s Approach to Privacy by Default
Trust Guardian platform represents a technical and organizational measure of Privacy by Default and by Design, as it minimizes, by default, the personal data collected and processed. This helps reduce the risk of excessive or non-compliant processing and contributes to more responsible management of personal data.