From the earliest stages of project development, businesses
engaged in the processing of individuals' personal data are
required to implement 'privacy by design' and 'privacy
be default' – two central principles of the GDPR as set
out in Article 25. What this means in practice is that data privacy
features and data privacy enhancing technologies should be embedded
directly into the design of projects at an early stage, while also
ensuring that user service settings must be automatically data
protection friendly, and only data which is necessary for each
specific purpose of the processing should be gathered at all.
Privacy by design is proactive and involves anticipating and
preventing privacy invasive events before they happen. On the other
hand, privacy by default aims to ensure that no action is required
on the part of the relevant individual to protect their privacy it
is built into the system by default such that if an individual
takes no action to apply his
