Data Protection becomes increasingly important, especially in the digital world. Data Protection by Design and by Default (“DPbDD”) plays a critical role in this connection and has been enshrined in Article 25 the EU General Data Protection Regulation (“GDPR”). Data Protection by Design requires that data protection principles are to be taken into consideration at the earliest stage of the design process, while Data Protection by Default should ensure that, by default, only personal data that are necessary for each purpose of the processing are processed. Even though Article 25 GDPR specifically addresses data controllers (e.g. companies or public administrations using software for processing personal data), developers may find it useful to get familiar with DPbDD requirements for creating GDPR compliant software that enables data controllers to fulfill their data protection obligations. This could possibly lead to competitive advantages over competitors who do not design their products with data protection principles in mind.

1. Data Protection by Design
and by Default for Developers
12 November 2021
Avv. Christian Notdurfter

2. Contents
1. Introduction
2. Data Protection by Design
3. Data Protection by Default
4. Recommendations
5. Conclusions

3. 1. Introduction
Processing
Personal
Data
GDPR

4. 1. Introduction
Controller
Processor
Data Subject

5. Data Subject = identified or identifiable natural person
whose personal data is collected or
otherwise processed
1. Introduction

6. 1. Introduction
Controller
Processor
Data Subject

7. Controller
Processor
= determines purposes
and means of processing
(e.g. a company sending
e-mail newsletters to its
subscribers)
1. Introduction

8. Controller
Processor = processes personal data on
behalf of the controller (e.g. an e-
mail newsletter service provider)
1. Introduction

9. Controller
Processor
1. Introduction
subject to the requirements
of DPbDD (Art. 25 GDPR)

10. 1. Introduction
Controller
Processor
Developer /
Producer?

11. Developer /
Producer?
Recital 78 GDPR:
Producers “should be encouraged“ to take
data protection into account when
developing and designing products and to
make sure that controllers are able to fulfil
their data protection obligations.
DPbDD “should also be taken into
consideration” in the context of public
tenders.
1. Introduction

12. Contents
1. Introduction
2. Data Protection by Design
3. Data Protection by Default
4. Recommendations
5. Conclusions

13. From the very beginning and in all stages of design of processing
activities (from development, procurerment to maintenance, deletion),
the controller shall implement appropriate technical and organisational
measures (TOM)
designed to implement data protection principles in an effective
manner
2. Data Protection
by Design

14. 2. Data Protection
by Design
From the very beginning and in all stages of design of processing
activities (from development, procurerment to maintenance, deletion),
the controller shall implement appropriate technical and organisational
measures (TOM)
designed to implement data protection principles in an effective
manner

15. 2. Data Protection
by Design
From the very beginning and in all stages of design of processing
activities (from development, procurerment to maintenance, deletion),
the controller shall implement appropriate technical and organisational
measures (TOM)
designed to implement data protection principles in an effective
manner

16. Data
Protection
Principles:
(a) Lawfulness,
Fairness &
Transparency
(b) Purpose
Limitation
(c) Data
Minimisation
(d) Accuracy
(e) Storage
Limitation
(f) Integrity and
Confidentiality
(Security)
Accountability!
2. Data Protection
by Design

17. Data
Protection
Principles:
(a) Lawfulness,
Fairness &
Transparency
(b) Purpose
Limitation
(c) Data
Minimisation
(d) Accuracy
(e) Storage
Limitation
(f) Integrity and
Confidentiality
(Security)
Accountability!
2. Data Protection
by Design

18. Data
Protection
Principles:
(a) Lawfulness,
Fairness &
Transparency
(b) Purpose
Limitation
(c) Data
Minimisation
(d) Accuracy
(e) Storage
Limitation
(f) Integrity and
Confidentiality
(Security)
Accountability!
2. Data Protection
by Design

19. Data
Protection
Principles:
(a) Lawfulness,
Fairness &
Transparency
(b) Purpose
Limitation
(c) Data
Minimisation
(d) Accuracy
(e) Storage
Limitation
(f) Integrity and
Confidentiality
(Security)
Accountability!
2. Data Protection
by Design

20. Contents
1. Introduction
2. Data Protection by Design
3. Data Protection by Default
4. Recommendations
5. Conclusions

21. Controller shall implement appropriate technical and
organisational measures (TOM)
for ensuring that, by default, only personal data that are
necessary for each purpose are processed,
as to: (a) amount of data collected; (b) extent of
processing; (c) storage period; and (d) their accessibility.
3. Data Protection
by Default

22. Controller shall implement appropriate technical and
organisational measures (TOM)
for ensuring that, by default, only personal data that are
necessary for each purpose are processed,
as to: (a) amount of data collected; (b) extent of
processing; (c) storage period; and (d) their accessibility.
3. Data Protection
by Default

23. Controller shall implement appropriate technical and
organisational measures (TOM)
for ensuring that, by default, only personal data that are
necessary for each purpose are processed,
as to: (a) amount of data collected; (b) extent of
processing; (c) storage period; and (d) their accessibility.
3. Data Protection
by Default

24. Contents
1. Introduction
2. Data Protection by Design
3. Data Protection by Default
4. Recommendations
5. Conclusions

25. Think about
data protection
from the very
beginning
4. Recommendations

26. Think about
data protection
from the very
beginning
Integrate
DPbDD in
procurement,
development &
life-cycle
4. Recommendations

27. Think about
data protection
from the very
beginning
Integrate
DPbDD in
procurement,
development &
life-cycle
Think about
guarantees
(e.g.
certification)
4. Recommendations

28. Help
controllers to
comply
Think about
data protection
from the very
beginning
Integrate
DPbDD in
procurement,
development &
life-cycle
Think about
guarantees
(e.g.
certification)
4. Recommendations

29. Help
controllers to
comply
Protect
children &
other
vulnerable
groups
Think about
data protection
from the very
beginning
Integrate
DPbDD in
procurement,
development &
life-cycle
Think about
guarantees
(e.g.
certification)
4. Recommendations

30. Help
controllers to
comply
Protect
children &
other
vulnerable
groups
Think about
data protection
from the very
beginning
Integrate
DPbDD in
procurement,
development &
life-cycle
Think about
guarantees
(e.g.
certification)
Read guidance
from DPAs /
EDPB
4. Recommendations

31. Source: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-
42019-article-25-data-protection-design-and_en (accessed 7 November 2021)
4. Recommendations

32. Contents
1. Introduction
2. Data Protection by Design
3. Data Protection by Default
4. Recommendations
5. Conclusions

33. Data Protection
by Design
Data Protection
by Default
5. Conclusions 1. No GDPR obligations if
you are not a controller.

34. Data Protection
by Design
Data Protection
by Default
5. Conclusions 1. No GDPR obligations if
you are not a controller.
2. A contractual
obligation?

35. Data Protection
by Design
Data Protection
by Default
5. Conclusions 1. No GDPR obligations if
you are not a controller.
2. A contractual
obligation?
3. Public tenders?

36. Data Protection
by Design
Data Protection
by Default
5. Conclusions 1. No GDPR obligations if
you are not a controller.
2. A contractual
obligation?
3. Public tenders?
4. A competitive
advantage?

37. Thank you
Avv. Christian Notdurfter
T +39 392 9100 581 Via Paul von Sternbach 1 Corso Magenta 63
E contact@notdurfter.com 39031 Brunico (Bolzano) 20123 Milano