Data protection by default
Data protection by default is the obligation in Art. 25(2) GDPR for the controller to implement appropriate technical and organisational measures ensuring that, by default, only personal data which are necessary for each specific purpose are processed. The obligation covers the amount of data collected, the extent of processing, the storage period and accessibility, and specifically requires that personal data are not made accessible to an indefinite number of people without the individual's intervention.
In practice, this means that the most privacy-protective settings must be the pre-selected ones: a health app should not share data with third parties or enable location tracking unless the user turns it on; an EDC system should give site users access only to their own subjects; retention periods should be configured to the documented schedule rather than left indefinite; and optional data fields should be off unless the protocol requires them.
The EDPB Guidelines 4/2019 explain that "default" applies to both the controller's own choices and the configuration of systems bought from vendors. It complements data protection by design and gives operational teeth to the data minimisation and storage limitation principles. Failure to configure defaults properly has been the basis of several enforcement decisions against social media and adtech platforms, and is increasingly assessed in HealthTech investigations.
Configure the platform to process only the personal data needed for each purpose without requiring users to reduce unnecessary exposure themselves. Practical examples include limiting site access to relevant records, disabling unnecessary fields and setting justified retention periods. Check vendor defaults rather than assuming the standard configuration meets Article 25 GDPR.
