Fundamentals

Privacy by Design: What It Is, Its Principles, and How It Works

By Daniel Sardá · Published on October 22, 2026

6 min read1,230 words

Privacy by design builds limits and safeguards into the first decisions about data instead of adding controls after a system has already been built.

Before creating a form, an app, or an administrative process, one decision shapes all the others: which data will be collected, what they will be used for, and how long they will be kept. Privacy by design means answering those questions from the outset and building the necessary safeguards into the entire life cycle of information. It is not a layer added after a system is finished.

The approach aims to prevent problems rather than merely repair them. If an organization realizes at the end that it collects unnecessary information, it may already have built processes, permissions, and business models around it. Correcting them will be harder than setting limits from the first decision.

Key idea: The first privacy measure is not hiding all data more effectively, but deciding which data need not be collected at all.

What privacy by design means

The expression was developed by Ann Cavoukian beginning in the 1990s. Her formulation brings together seven foundational principles: be proactive; make privacy the default; embed it into design; seek positive-sum solutions; protect data throughout their life cycle; provide visibility and transparency; and respect the interests of the individual.

These principles are best understood not as seven separate boxes to tick, but as a way of making decisions: anticipate risks; limit information to a defined purpose; integrate protections into architecture and organizational practice; and enable people to understand and control what happens to their data.

The Spanish Data Protection Agency connects this approach to the earliest stages of any processing operation and to its full life cycle. That includes not only collection, but also use, access, retention, disclosure, and deletion.

Design, privacy by default, and security are not the same

These ideas support one another, but they answer different questions.

Privacy by design concerns architecture and process. It requires asking in advance what purpose justifies processing, what information is necessary, who may use it, and how it will cease to be available.

Privacy by default describes what happens when a person changes no settings. The initial configuration should protect privacy: it should not make a profile public, enable optional tracking, or retain data indefinitely without a conscious decision. Design organizes the system; privacy by default ensures that its starting point uses and exposes only what is necessary.

Information security protects data against improper access, alteration, or loss. It is indispensable, but it does not by itself answer the prior question: should those data have been collected? A system may encrypt and safeguard very effectively information it never needed to request.

Nor are encryption, pseudonymization, anonymization, and consent interchangeable. They may be useful measures in particular contexts, but none alone resolves decisions about purpose, necessity, access, and retention.

Useful distinction: Security asks how to protect data. Privacy also asks whether they should exist, who decides about them, and when they should be deleted.

Criteria that guide a decision

Applying privacy from the design stage requires turning general ideas into observable criteria:

• Defined purpose: explain why each datum is needed before collecting it, and avoid incompatible or unexpected reuse.
• Data minimization: limit the amount of data, their uses, the retention period, and the people with access. It does not mean collecting “the minimum” in the abstract, but what is necessary for a specific purpose.
• Protective defaults: make the initial option the least intrusive one that still permits the service to be provided.
• Limited access: allow each person or system to consult only the information necessary for its role.
• Transparency and control: communicate decisions in understandable terms and provide effective ways to exercise the available choices.
• Continuous review: check whether the purpose, risks, or technology have changed, and remove data when they are no longer necessary.

Some choices are difficult. Reducing collection may limit a feature or future analysis, and integrating safeguards may require more work at the start. The approach does not deny those costs: it requires making them visible and justifying why an intrusion is necessary. It also encourages alternatives that preserve utility without accumulating information by mere inertia.

An example: the form that asks for too much

Imagine an organization preparing a newsletter sign-up form. The first version asks for a full name, date of birth, postal address, telephone number, and email address. The reason is not that all of these data are indispensable, but that they “might be useful later.”

A privacy-by-design review begins with the current purpose: delivering the newsletter. If an email address is enough, the other fields are removed. The organization then restricts access to the mailing list, clearly explains what it will send, avoids enabling additional uses without a separate choice, and establishes when inactive records will be erased. It also decides how to handle an unsubscribe request and how to verify that deletion works.

Protection does not depend on a single control. It runs through the life cycle:

1. define the purpose before collection;
2. request only the data that are necessary;
3. restrict their use and access to them;
4. set a justifiable retention period;
5. effectively delete or transform the information when that period ends.

This is a simple case, but it reveals the central change: data cease to be treated as a resource worth accumulating “just in case.” Each collection creates a capacity to observe, classify, or influence other people and therefore requires a reason.

A guiding principle and, in Europe, a specific obligation

Privacy by design is a broader framework that predates the General Data Protection Regulation (GDPR). Within the GDPR’s scope, however, data protection by design and by default is a specific legal obligation.

Article 25 of the GDPR requires controllers to implement appropriate technical and organizational measures, taking into account factors such as the nature, context, purposes, risks, state of the art, and cost. It also provides that, by default, only the personal data necessary for each specific purpose are processed. The European Data Protection Board’s guidelines emphasize that measures should be considered before and during processing and reviewed case by case.

This does not make the GDPR a universal rule, nor does it mean that adopting one isolated measure guarantees compliance. The applicable law, legal basis, context, and risks still matter. It is useful to distinguish the design method from the broader concept of a right to privacy.

Caution: Adopting the seven principles does not certify compliance, anonymity, or complete security. The result depends on verifiable decisions and sustained review.

Limiting informational power from the start

Privacy by design does not promise zero risk. Nor does it replace security, the accountability of those who process data, or scrutiny of the applicable law. Its contribution is more specific: it requires discussing limits while a system can still be designed differently.

From the perspective of individual liberty, that anticipation matters because accumulating information expands the power of companies, governments, and other organizations over people. The answer is not to prohibit every useful use of data, but to require a purpose, reduce what is unnecessary, and preserve real spaces for choice.

The decisive question, then, is not what notice to add at the end. It is what data and what powers the design enables from the beginning, who may exercise them, and which limits will prevent them from becoming permanent.