Privacy by default means choosing default settings so that, by default, only the personal data necessary for the specific purpose is processed.
What the default settings cover
The obligation applies to the amount of data collected, the extent of its processing, the period of storage and its accessibility. Personal data must not be made accessible to an indefinite number of people without the individual's intervention.
Examples
Social network profiles are not public at first, optional form fields are not pre-filled and tracking is disabled until consent is given. Anyone who wants to share more has to change the setting actively.
Legal provisions
- Art. 25(2) GDPR
- Data protection by default.
- Art. 5(1)(c) GDPR
- Principle of data minimisation.
Related terms.
Privacy by design Privacy by design means building data protection into the technical and organisational design of systems, products and processes from the outset. Art. 25(1) GDPR 
Data minimisation Data minimisation is the principle that only as much personal data may be processed as is necessary for the purpose in question. Art. 5(1)(c) GDPR Technical and organisational measures (TOMs) Technical and organisational measures are the specific precautions a company takes to protect personal data. Art. 32 GDPR
All terms from A to Z Data minimisation Data minimisation is the principle that only as much personal data may be processed as is necessary for the purpose in question. Art. 5(1)(c) GDPR Technical and organisational measures (TOMs) Technical and organisational measures are the specific precautions a company takes to protect personal data. Art. 32 GDPR 