Article 25 of the GDPR requires data protection by design and by default. In practice, the difference between compliance on paper and privacy that works comes down to when and how the privacy team gets involved.
- Get in early. Build privacy checkpoints into project and procurement gates, not just launch reviews.
- Make impact assessments change decisions. A DPIA that never alters a design is a form, not a control.
- Minimise by default. Collect only what is needed and make the privacy-friendly option the default setting.
- Automate retention. Deletion rules written into systems beat policies that rely on memory.
- Keep evidence. Record decisions and trade-offs so accountability can be demonstrated.
These habits matter even more as organisations adopt AI, where training data, profiling and transparency raise new questions for privacy professionals.
