The Assurance Desk
Part of the guide What are the UK GDPR principles? All seven, in plain English
What is privacy by design?
Privacy by design is the everyday name for a UK GDPR duty. You consider the privacy and data protection issues of any system, service, product or process at the design stage. You keep considering them for as long as it is in use.
The duty sits in Article 25 of the UK GDPR. It applies when you decide how you will use personal data, and again while you use it. At both points the controller must put in place suitable technical and organisational measures. The law gives pseudonymisation as one example.
Our guide to the UK GDPR principles explains what they are. This guide explains how to build them into your systems and habits.
What is data protection by design and by default?
Data protection by design and by default is the UK GDPR's own name for privacy by design. By design is about how you build. By default is about what happens when nobody changes the settings.
By design is not one fixed list. Article 25 says the controller weighs the state of the art and the cost. It also weighs the nature, scope, context and purposes of the processing, and the risks to people. So a firm whose data use is not likely to be high risk may need only some simple steps.
By default means you use only the personal data you need for each specific purpose. UK GDPR applies that to the amount you collect, the extent of processing, how long you keep it and who can access it. Personal data must not be open to an unlimited number of people unless the person chooses that.
By default does not mean switching everything off. The ICO says it is about deciding what is right for your processing and the risks it poses to people.
The two halves of Article 25
By design
- Consider data protection at the design stage
- Keep considering it for the whole life of the system
- Weigh the state of the art, the cost, the nature and purpose of the processing, and the risks to people
By default
- Use only the personal data each purpose needs
- Limit how much you collect and how far you process it
- Limit how long you keep it and who can access it
Who must do it: controllers, processors or suppliers?
The controller must. If you decide how and why personal information is used, you are a controller. The controller is responsible for data protection by design and by default.
The ICO says firms whose software, products, apps or websites collect, manage or share personal information are likely to be controllers. So a firm that builds software or apps is likely to hold the duty itself.
Processors, firms that handle personal data on your behalf, are not directly bound by the design rules. The controller stays responsible. It must only use processors that give sufficient guarantees that their processing meets the UK GDPR. Our guide to processor contracts covers what that contract must say.
A firm that only buys software still has a part to play. The ICO says you should include data protection by design in any decision about the products and services you use.
What does privacy by design look like in a small firm?
For most small firms it is a set of plain habits, not a project. The ICO lists practical steps, and the checklist below gathers them.
If you build software, the ICO's product design guidance covers every phase, from kick-off and research to design, development, launch and after launch. It also asks teams to check that third-party code libraries are secure and unlikely to leak private information.
Product teams should question any collection of personal information that seems unnecessary and raise it with their data protection officer or legal colleagues. The ICO adds that processing that is not necessary may be unlawful.
A privacy by design checklist, from ICO guidance
- Keep an up-to-date data map of the personal information you hold and use
- Collect only the personal information you really need
- Let people use as much of the product as possible without giving personal information
- Make sure default settings offer strong privacy protection
- Give staff and others access only to the information they need
- Protect stored, backed-up and moving data with encryption, hashing or similar methods
- Set retention rules and delete what you no longer need
How does privacy by design connect to a DPIA?
A data protection impact assessment, or DPIA, is one of the main tools. If your use of personal information is likely to result in a high risk to people's rights and freedoms, you must complete one.
The ICO calls DPIAs a key part of the law's focus on accountability and data protection by design. Our guide to a DPIA for an AI tool explains when one is needed and what it records.
What changed for children's online services in 2026?
The UK's Data (Use and Access) Act 2025 added the children's higher protection matters to Article 25 in February 2026.
They apply if you provide an online service likely to be used by children. You must take them into account when you decide which measures are appropriate. The law calls such services information society services.
One matter is how children can best be protected and supported when they use the service. Another is that children have different needs at different ages and stages of development.
What to do
- Map the personal information you hold, what you use it for and who can see it.
- Ask whether each new form field or feature really needs personal information.
- Check your default settings give strong privacy protection.
- Bring data protection into decisions about the products and suppliers you use.
- Complete a DPIA where your use of personal information is likely to be high risk.
Common questions
What does privacy by design mean when we buy an AI tool?
The ICO says a firm buying an AI system must make its own judgement of the trade-offs as part of its due diligence. It must set out its requirements at the procurement stage. If you cannot assess whether the tool would comply with data protection law, the ICO's good practice is to choose a different one. The ICO's AI guidance is under review after the Data (Use and Access) Act.
How do solo developers handle a DPIA without breaking the bank?
First check whether you need one. A DPIA is required where your use of personal information is likely to be high risk. Lower-risk use may need only some simple steps. Free material exists. Handley Gill, one provider, publishes free compliance checklists and templates, including a DPIA template. The Assurance Desk recorded this from its website on 16 July 2026.
Is ICO 'should' guidance the same as the law?
No. In its product design guidance, the ICO says 'should' is not a legal requirement. It is what the ICO expects you to do to comply effectively with the law.
Where next
Sources
- ICO, Data protection by design and by default, checked 22 October 2026
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), checked 22 October 2026
- ICO, Development, checked 22 October 2026
- ICO, Privacy in the product design lifecycle, checked 22 October 2026
- ICO, What are the accountability and governance implications of AI?, checked 22 October 2026
- The Assurance Desk, Handley Gill profile, checked 22 October 2026
This is an independent editorial guide, not legal advice.