GDPR for research suppliers: what "privacy by default" means in practice

GDPR's "privacy by default" principle (Article 25) says that when a system offers a choice about how personal data is processed, the default setting — the one a user gets without touching anything — has to be the most privacy-protective option. Not the one that's most convenient for the business. That ordering is easy to state and surprisingly easy to get backwards in practice.

The clearest place it shows up is data minimization: collecting only what a given feature actually needs, not what might be useful later. An account system needs an email address to authenticate; it doesn't need a phone number unless there's a specific feature — two-factor auth, order-status SMS — that requires one. Every optional field is a design decision, not a default.

Retention is the other half. Data that's collected for a purpose should have a lifespan tied to that purpose, not persist indefinitely because deleting it was never scheduled. An abandoned cart, a magic-link sign-in token, an old shipping address — each of these has a point past which keeping it serves no purpose the user consented to.

None of this is exotic. It's closer to plumbing than to policy: decide what each field is for, decide when it stops being needed, and build the deletion path at the same time as the collection path — not as a follow-up ticket.