Article 25 GDPR : Data Protection by Design and by Default Principles

Data Protection by Design (Art. 25.1 GDPR)

In accordance with EDPB Guidelines 4/2019, the principle of Data Protection by Design requires the controller to embed GDPR compliance into the early architecture of systems, applications, and organizational processes.

This assessment must take into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of natural persons.

• Application of pseudonymisation and encryption across data flows and storage layers;
• Native integration of retention schedules and automated purging of expired records;
• Granular access control based on the principle of least privilege.

Data Protection by Default (Art. 25.2 GDPR)

The principle of Data Protection by Default mandates that, by default, only personal data strictly necessary for each specific purpose of the processing are processed.

This applies to the amount of personal data collected, the extent of their processing, the period of their storage, and their accessibility (data must never be made accessible without human intervention to an indefinite number of natural persons).

Blockchain: Designing Architecture to Safeguard Rights

EDPB Final Guidelines 02/2025 reiterate that a blockchain is not, in itself, a processing operation, but that its intrinsic characteristics can make GDPR compliance challenging. The controller must therefore justify upstream the necessity of using such an architecture and document explored alternatives.

Personal data should not be stored directly on-chain when less intrusive alternatives exist. Off-chain architectures, minimised data, and technical mechanisms enabling the effective exercise of rights must be prioritized at the design stage.

• Determine controllers, processors, or joint controllers according to actual network governance;
• Prefer permissioned blockchains where this allows for clearer allocation of roles and access control;
• Verify the strict necessity of a public ledger before making data accessible to an indefinite number of individuals;
• Assess the impact of immutability on erasure and rectification rights, incorporating this analysis into the DPIA where required.

Verified Official Sources

Associated Operational Micro-Tools

See Also in the Legal Framework