Privacy by Design - Building Privacy In from the Start
About 2 min read
Privacy by Design is a design principle that builds privacy protection into systems and services from the planning and design stages. Rather than "adding privacy measures afterward," it places privacy at the very core of the architecture, structurally reducing the risk of leaking personal information. It was advocated in the 1990s by Dr. Ann Cavoukian, then the Information and Privacy Commissioner of Ontario, Canada, and became a global design standard after being codified as a legal obligation in Article 25 of the GDPR, which took effect in 2018.
Dr. Ann Cavoukian's 7 Principles
Prevent privacy violations from occurring rather than responding after they happen.
Ensure the most privacy-protective state even when the user configures nothing.
Privacy is not an add-on feature but is integrated into the core design of the system.
Privacy and functionality are not a trade-off; both can be achieved together.
Ensure privacy at every stage, from data collection to disposal.
Disclose how processing works and enable independent verification.
Prioritize the interests of individuals and let users control their own data.
Legal Obligation Under GDPR Article 25
Article 25 of the GDPR, titled "Data protection by design and by default," elevated Privacy by Design to a legal obligation. Data controllers must implement appropriate technical and organizational measures to apply principles such as data minimization, both at the time of determining the means of processing and at the time of processing itself. Violations may incur fines of up to 4% of total worldwide annual turnover or 20 million euros, whichever is higher. Japan's Act on the Protection of Personal Information was also amended in 2022 to strengthen security control measures, making design-stage countermeasures effectively necessary.
The Principle of Data Minimization
The most important and immediately effective aspect of implementing Privacy by Design is data minimization. It is the principle of "collecting and retaining only the minimum data necessary for the purpose," and concretely it means design decisions such as the following. Do not collect a real name if it is unnecessary for user registration. Anonymize data if there is no need to identify individuals for analysis. Set retention periods and automatically delete data that is no longer needed. Use data masking and pseudonymization to keep access to raw data to a minimum.
Privacy by Default
- All data public by default
- Opt-out model (data is shared unless you change the setting yourself)
- Continuously collect location data
- Retain data indefinitely even after account deletion
- Private by default
- Opt-in model (shared only when explicitly consented)
- Collect location data only when needed
- Set retention periods and delete automatically
Contrast with Dark Patterns
Dark patterns are a design technique at the opposite extreme of Privacy by Design. Techniques such as making the consent button prominent while shrinking the reject button, complicating the settings screen to make changing privacy settings difficult, and deliberately making the account-deletion process cumbersome all impede users' autonomous decision-making. The EU Digital Services Act (DSA) has explicitly prohibited dark patterns since 2024, and UI designs that violate the principles of Privacy by Design now carry legal risk.
Real-World Use Cases
"In a design review for a new service, I pointed out where the IP address was being included in user behavior logs. Since an anonymized identifier was sufficient for analytical purposes, we changed the design to achieve data minimization. As a result, we also significantly reduced GDPR compliance costs."
For balancing privacy and convenience, see the article on privacy versus convenience; for specific configuration methods, see the privacy settings guide; and for protecting your digital identity, see the article on digital identity protection, which explain these topics in detail.privacy protection books on Amazon are also helpful references for institutional design.
Was this article helpful?