What do privacy by design and privacy by default mean?
By Advisorn · updated on 25 October 2026 · Art. 6 and 7 FADP, Art. 25 GDPR
In short
Data protection by design (privacy by design) requires a processing to be set up, from the planning stage, so that it complies with the law, in particular with its principles (Art. 7 para. 1 FADP). Data protection by default (privacy by default) requires systems to be configured so that processing is limited to the minimum necessary, unless the person decides otherwise (Art. 7 para. 3 FADP).
What it means in practice
- when you choose software, ask what data it collects and where it keeps it;
- a form asks only for the fields that are needed, and optional ones are marked;
- consent boxes are not ticked in advance;
- a profile, an app or an account starts with the most private settings;
- data is deleted automatically when the retention period expires.
How much must be done
The measures must be appropriate to the state of the art, the type and extent of the processing and the risks for the people (Art. 7 para. 2 FADP). The most expensive solution is not needed, but a reasoned and documented choice is.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.