Summary of Guidelines 4/2019 on Data Protection by Design and by Default

What it covers

This document is a short quick-reference summary of the obligation to implement data protection by design and by default under Article 25 GDPR, covering when to act, the four assessment factors, the four dimensions of default data minimisation, and a practical action checklist; the full guidelines carry the detailed legal analysis.

Why it matters

It gives organisations, particularly small businesses, an accessible checklist for applying Article 25 obligations without needing to work through the full guidelines first.

Refer to it when

• quickly orienting staff on data protection by design and default duties
• checking default settings against the four necessity dimensions
• using the action checklist during procurement or system design
• before consulting the full guidelines for detailed analysis

Questions this document addresses

• What must organisations do to implement data protection by design?
• What are the four factors used to assess appropriate measures?
• What default settings are required across the four dimensions of data minimisation?
• How can small businesses operationalise DPbDD as part of accountability?

Topics

• Data protection by design
• Pseudonymisation
• Security of processing
• Transparency