--- title: "Art. 25 GDPR: Data protection by design and by default" canonical: "https://dposchool.com/gdpr/article/25" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_25" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 25 GDPR · Chapter IV: Controller and processor · Section 1: General obligations # Article 25 GDPR: Data protection by design and by default Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The controller must implement appropriate technical and organisational measures, such as pseudonymisation, designed to implement the data protection principles effectively (data protection by design). It must also ensure that, by default, only the personal data necessary for each specific purpose are processed (data protection by default). ## Official text ### Article 25(1) **1.** Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. ### Article 25(2) **2.** The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons. ### Article 25(3) **3.** An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 25 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_25) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 78](https://dposchool.com/gdpr/recital/78) ## Court of Justice judgments ### [C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23) Judgment of 2 December 2025 · ECLI:EU:C:2025:935 An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492) ## EDPB guidance ### [Guidelines 02/2025 on processing of personal data through blockchain technologies](https://dposchool.com/gdpr/guidance/edpb-02-2025) EDPB 02/2025 · Final · First published 14 April 2025 · Final version 7 July 2026 Version 2 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en) ### [Guidelines 01/2025 on pseudonymisation](https://dposchool.com/gdpr/guidance/edpb-01-2025) EDPB 01/2025 · Draft for consultation · First published 17 January 2025 Consultation closed 14 March 2025; final version not yet published. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012025-on-pseudonymisation_en) ### [Guidelines 03/2022 on deceptive design patterns in social media platform interfaces](https://dposchool.com/gdpr/guidance/edpb-03-2022) EDPB 03/2022 · Final · First published 21 March 2022 · Final version 24 February 2023 Version 1 was titled 'dark patterns'. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032022-on-deceptive-design-patterns-in-social-media-platform_en) ### [Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications](https://dposchool.com/gdpr/guidance/edpb-01-2020) EDPB 01/2020 · Final · First published 7 February 2020 · Final version 9 March 2021 Final version 2.0. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012020-on-processing-personal-data-in-the-context-of-connected_en) ### [Guidelines 4/2019 on Article 25 Data Protection by Design and by Default](https://dposchool.com/gdpr/guidance/edpb-04-2019) EDPB 04/2019 · Final · First published 20 November 2019 · Final version 20 October 2020 Version 2.0 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-42019-on-article-25-data-protection-by-design-and-by-default_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [IQVIA Solutions Italy S.r.l: EUR 7,000,000](https://dposchool.com/gdpr/fine/garante-iqvia-2026-09) Garante per la protezione dei dati personali, Italy · Decision of 23 September 2026 · Appeal status: unknown Health-analytics firm treated a database of about one million GP patients as anonymous when a persistent identifier made them re-identifiable; no legal basis, no information, no DPIA, weak retention and security. [Source: the authority](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en) ### [McDonald’s Polska Sp. z o.o.: PLN 16,932,657](https://dposchool.com/gdpr/fine/uodo-mcdonalds-2025-07) Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority), Poland · Announced on 21 July 2025 · Appeal status: unknown Outsourced staff scheduling without risk analysis or supervision of the processor, so employee data (names, PESEL or passport numbers, shifts) ended up in a public directory. Not fully confirmed: Decision date not shown on the page (announcement date used). Three fines: PLN 1,632,063 + 13,600,528 + 1,700,066. The processor was fined PLN 183,858 in total. Articles taken from the narrative; the page does not give a single list of infringed articles. [Source: the authority](https://uodo.gov.pl/pl/138/3827) ### [Luka Inc.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04) Garante per la protezione dei dati personali, Italy · Decision of 10 April 2025 · Appeal status: unknown AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors. [Source: the authority](https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en) ### [Meta Platforms Ireland Limited: EUR 251,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-12) Data Protection Commission (Ireland), Ireland · Decision of 12 December 2024 · Appeal status: under appeal A 2018 'View As' token flaw exposed about 29 million Facebook accounts (about 3 million in the EU/EEA); incomplete breach notification and poor design and default safeguards. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiries-meta-platforms-ireland-limited-token-breach) ### [Posti: EUR 2,400,000](https://dposchool.com/gdpr/fine/fi-posti-2024-11) Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland), Finland · Decision of 13 November 2024 · Appeal status: unknown Automatically opened an OmaPosti electronic mailbox for customers, tied to other services, with a pre-ticked box and without clear information. Not fully confirmed: Confirmed on the EDPB news page. Fine for Art. 5 and 6(1); reprimand and order for Art. 13; instruction on Art. 25. Company name given only as 'Posti'. [Source: the authority](https://www.edpb.europa.eu/news/finnish-sa-administrative-fine-imposed-on-posti-for-unlawful-processing-of-personal-data_en) ### [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11) Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601) ### [Enel Energia S.p.A.: EUR 79,107,101](https://dposchool.com/gdpr/fine/garante-enel-energia-2024-02) Garante per la protezione dei dati personali, Italy · Decision of 8 February 2024 · Appeal status: upheld Telemarketing: weak control of sales-agent access let unauthorised agencies place contracts obtained through unlawful calls into the company's systems; failures of security, accountability, privacy by design and processor contracts. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9988710) ### [TikTok Technology Limited: EUR 345,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2023-09) Data Protection Commission (Ireland), Ireland · Decision of 1 September 2023 · Appeal status: under appeal Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited-september-2023) ### [Meta Platforms Ireland Limited: EUR 265,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2022-11) Data Protection Commission (Ireland), Ireland · Decision of 25 November 2022 · Appeal status: under appeal Facebook search and contact-importer tools allowed scraping of a large dataset of user data; failure of data protection by design and by default. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-meta-dataset-november-2022) ### [Meta Platforms Ireland Limited: EUR 405,000,000](https://dposchool.com/gdpr/fine/dpc-instagram-2022-09) Data Protection Commission (Ireland), Ireland · Decision of 2 September 2022 · Appeal status: under appeal Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-processing-personal-data-relating-child-users-instagram-social-networking-service) ### [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02) Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO. [Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr) ### [Deliveroo Italy s.r.l.: EUR 2,500,000](https://dposchool.com/gdpr/fine/garante-deliveroo-2021-07) Garante per la protezione dei dati personali, Italy · Decision of 22 July 2021 · Appeal status: unknown Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9685994) ### [Deutsche Wohnen SE: EUR 14,500,000](https://dposchool.com/gdpr/fine/blnbdi-deutsche-wohnen-2019-10) Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Germany · Decision of 30 October 2019 · Appeal status: reduced Property company kept years-old tenant documents (pay slips, bank statements, tax and health-insurance data) in an archive system with no means of deleting data no longer needed. [Source: the authority](https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20191105-PR-Translation-Fine_DW.pdf) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 25 Previous: [Art. 24 GDPR: Responsibility of the controller](https://dposchool.com/gdpr/article/24) Next: [Art. 26 GDPR: Joint controllers](https://dposchool.com/gdpr/article/26) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents