Data protection by design and by default
Art. 25
-
Last updated
Mandatory
Catalog reference
Build data protection into processing systems and business practices from the outset (by design) and configure defaults so only necessary personal data is processed for each specific purpose (by default) — not bolted on afterwards.
Narrative — how we satisfy this requirement
The ISMS Manager checks new services and changes in a design review for minimal data, safe defaults, and access before the Change Manager approves them.