← GDPR · Controller obligations
Art.25 — Data protection by design and by default
Requirement
The controller shall implement data protection principles, such as data minimisation and pseudonymisation, both when determining the means of processing and at the time of processing (by design), and ensure that by default only the personal data necessary for each purpose is processed and not made accessible to an indefinite number of people (by default).
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| NDPA 2023 | s.24(2)-(3) | Technical and organisational measures, accountability and privacy by design | sdlc data-minimisation |
| CCPA/CPRA | 1798.100(c) | Purpose limitation and data minimisation | data-minimisation |
| SOC 2 | CC8.1 | Authorised change management | sdlc |
| ISO 27001 | A.5.8 | Information security in project management | sdlc |
| ISO 27001 | A.8.25 | Secure development life cycle | sdlc |
| ISO 27001 | A.8.31 | Separation of development, test and production environments | sdlc |
| PCI DSS 4.0.1 | 3.3 | Sensitive authentication data is not stored after authorisation | data-minimisation |
| PCI DSS 4.0.1 | 6.2 | Bespoke and custom software is developed securely | sdlc |