Art.25 Data protection by design and by default
Both at the time the means of processing are determined and at the time of the processing itself, implement appropriate technical and organisational measures such as pseudonymisation which are designed to implement the d
5
artefacts
2
held by a system
2
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The default configuration of each product surface, showing what is on out of the box for collection, sharing, visibility and retention · Cloud console / configuration management
- Change records showing privacy requirements were tracked as delivery requirements rather than as advice · Data governance / DLP tooling
periodic reviewEvidence produced at each review
- Design stage privacy review records for new and materially changed processing, dated before the means of processing were fixed · Data governance / DLP tooling
- Evidence that no personal data is by default accessible to an indefinite audience without an act by the individual · Data governance / DLP tooling
governing documentDocuments that govern the control
- The pseudonymisation, aggregation or separation techniques applied, and where they were considered and rejected the reason recorded · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Privacy review performed at launch approval rather than at design, when the decisions it should influence are already sunk
- Defaults set to the widest sharing and the longest retention, putting the burden on the individual to reduce them
- By design treated as satisfied by encryption alone, with no minimisation of what is collected in the first place
- The Article read as a single obligation, so the by default limb on amount, extent, storage period and accessibility is never separately evidenced
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.24 Responsibility of the controller · Art.26 Joint controllers