The European Data Protection Board (EDPB) has adopted
new Guidelines 4/2019 on Article 25: Data Protection by Design and
by Default (DPbDD) for consultation purposes. The closing date for
responses is 16 January 2020.
The Guidelines give general guidance on the obligation of DPbDD
imposed on controllers under Article 25 of the General Data
Protection Regulation ((EU) 2016/679) (GDPR). Article 25 makes
controllers responsible for effective implementation of the data
protection principles and data subjects' rights and freedoms by
design and by default. This requires that controllers implement
appropriate technical and organisational measures and necessary
safeguards, designed to implement data protection principles in an
effective manner and to protect the rights and freedoms of data
subjects. Article 25 also requires that, by default, only personal
data which is necessary for each specific purpose of the processing
is then processed.
