Data protection by design and by default
Art. 25
-
Last updated
Mandatory
Catalog reference
Build data protection into processing systems and business practices from the outset (by design) and configure defaults so only necessary personal data is processed for each specific purpose (by default) — not bolted on afterwards.
Narrative — how we satisfy this requirement
The ISMS Manager checks new services and changes in a design review for minimal data, safe defaults, and access before the Change Manager approves them.
Review
On trackNext review is 10/27/2027 — no urgency right now.
- Review cadence
- Every 365 days
- Last reviewed
- Next review due