EDPS Opinion: Data Protection By Design And Default

Data protection by design and default are concepts that put data protection at the centre of an organisation's information processes. The intention of these principles is that organisations develop and implement data processing structures, which, by their nature, will protect personal data. In other words, the aim is to plan for data protection from the ground up.

These principles are explicitly referenced in Article 25 of the General Data Protection Regulation ("GDPR"), which will come into force in May 2018. A recent opinion on big data, published by the European Data Protection Supervisor (the "EDPS Opinion"), has provided some additional insight on these principles. We examine these concepts and what they might mean for data controllers.