AI Governance Engineer
GitHub

Privacy by design and by default

By Updated

The GDPR Article 25 duty to build data protection principles into processing through technical and organisational measures, and to process by default only the personal data each purpose needs 1. In an AI stack it shows up as filters, retention rules and access limits enforced as code.

Developed in
ch. 19, Minimisation, privacy by design and PETs
Chapters
ch. 19, Privacy & AI
Source
1 numbered reference, listed below

Where it is used

The term is not used under this name in running prose; the sections listed under "Developed in" treat it.

  • Data minimisation

    The GDPR principle that personal data must be adequate, relevant and limited to what the purpose needs.

Sources

  1. [1] Regulation (EU) 2016/679 (General Data Protection Regulation) (Arts. 4(1), 4(5), 4(7), 4(8), 4(12), 4(14), 5, 6, 9, 12(3), 22, 25, 28(2) and 28(4), 30, 33, 35; Recital 26). Publications Office of the EU (EUR-Lex). 2016-04-27. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Privacy by design and by default. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/privacy-by-design-and-by-default. CC BY 4.0

BibTeX

@misc{aige2026privacybydesignandbydefault,
  author  = {Jorge García Aibar},
  title   = {{Privacy by design and by default}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/privacy-by-design-and-by-default}
}