Data protection by design
Data protection by design is the obligation in Art. 25(1) GDPR for the controller, both when determining the means of processing and at the time of the processing itself, to implement appropriate technical and organisational measures, such as pseudonymisation, designed to implement the data protection principles effectively and to integrate the necessary safeguards into the processing. The measures must take into account the state of the art, cost of implementation, and the nature, scope, context and purposes of processing, as well as the risks to individuals.
The concept translates the earlier privacy by design framework into a binding legal requirement. Operationally it means involving the DPO at the design stage of a protocol, a data platform or an AI model; carrying out the DPIA before, not after, vendor selection; specifying minimisation, encryption, access control, audit trails and retention in requirements documents; and choosing vendors whose products support these features (by default).
For life sciences, the EDPB Guidelines 4/2019 and the ISO 31700 standard on privacy by design for consumer products offer practical checklists. The EU AI Act extends the logic to high-risk AI systems, requiring risk management and data governance to be embedded throughout the lifecycle. Design decisions that are documented and traceable are also the most convincing evidence of accountability during an inspection or due diligence.
