What evidence do auditors commonly ask for on Art.25 Data protection by design and by default?

Design stage privacy review records for new and materially changed processing, dated before the means of processing were fixed; The default configuration of each product surface, showing what is on out of the box for collection, sharing, visibility and retention; The pseudonymisation, aggregation or separation techniques applied, and where they were considered and rejected the reason recorded; Change records showing privacy requirements were tracked as delivery requirements rather than as advice; Evidence that no personal data is by default accessible to an indefinite audience without an act by the individual.

What is the most common gap auditors find on Art.25?

Privacy review performed at launch approval rather than at design, when the decisions it should influence are already sunk

GDPR · Chapter IV - Controller and Processor

`Art.25` Data protection by design and by default

Both at the time the means of processing are determined and at the time of the processing itself, implement appropriate technical and organisational measures such as pseudonymisation which are designed to implement the data protection principles, in particular data minimisation, in an effective manner and to integrate the necessary safeguards into the processing, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of processing, and the risks of varying likelihood and severity for the rights and freedoms of natural persons. Separately, implement measures ensuring that by default only the personal data necessary for each specific purpose is processed, covering the amount of data collected, the extent of the processing, the period of storage and the accessibility of the data, and in particular ensuring that personal data is not by default made accessible to an indefinite number of natural persons without the individual's intervention.

Source: GDPR, Art.25. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

moderate

to go live

Cloud console / configuration management

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

The default configuration of each product surface, showing what is on out of the box for collection, sharing, visibility and retention · Cloud console / configuration management
Change records showing privacy requirements were tracked as delivery requirements rather than as advice · Data governance / DLP tooling

periodic reviewEvidence produced at each review

Design stage privacy review records for new and materially changed processing, dated before the means of processing were fixed · Data governance / DLP tooling
Evidence that no personal data is by default accessible to an indefinite audience without an act by the individual · Data governance / DLP tooling

governing documentDocuments that govern the control

The pseudonymisation, aggregation or separation techniques applied, and where they were considered and rejected the reason recorded · Policy repository / GRC workspace

First move

Start with the 2 of 5 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Privacy review performed at launch approval rather than at design, when the decisions it should influence are already sunk
Defaults set to the widest sharing and the longest retention, putting the burden on the individual to reduce them
By design treated as satisfied by encryption alone, with no minimisation of what is collected in the first place
The Article read as a single obligation, so the by default limb on amount, extent, storage period and accessibility is never separately evidenced

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.24 Responsibility of the controller · Art.26 Joint controllers