Compliance FrameworksEurope
GDPR Article 25
Privacy by Design: data minimisation, third-party processors, privacy by default documentation.
Privacy by Design: data minimisation, third-party processors, privacy by default documentation.
| Short name | GDPR Art.25 |
| Region | Europe |
| Country or scope | European Union |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers GDPR Art.25
- Scan requirements: 4, all decided by a scan.
- Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for GDPR Art.25.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for GDPR Art.25 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
GDPR-Art25-1 Privacy by Design Components | GDPR Art 25 requires privacy-preserving components | Scan |
GDPR-Art25-2 Data Minimization Assessment | GDPR Art 25(2) requires data minimization | Scan |
GDPR-Art25-3 Pseudonymization Components | GDPR Art 25 requires pseudonymization techniques | Scan |
GDPR-Art25-4 Controller Accountability | GDPR Art 25 requires controller accountability | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
ART25-PBD-1 | Embed Data Minimisation at Design Stage |
ART25-PBD-2 | Implement Pseudonymisation and Anonymisation Controls |
ART25-PBD-3 | Conduct Privacy Impact Review Before System Changes |
ART25-PBD-4 | Integrate Privacy Controls into the Software Development Lifecycle |
ART25-PBDF-1 | Configure Privacy-Preserving Defaults for User-Facing Products |
ART25-PBDF-2 | Enforce Retention Limits by Default |
ART25-PBDF-3 | Restrict Internal Access to Personal Data by Default |
ART25-CERT | Consider Approved Certification Mechanisms for Article 25 Compliance |
ART25-SCOPE | Define Scope of Personal Data Processing for Each System |
ART25-PROCESSOR | Ensure Processor Systems Implement Privacy by Design |
Policy templates
Written for GDPR Art.25:
- Privacy by Design and by Default Policy
- Data Protection Impact Assessment Procedure
And 22 from the standard set, adapted to GDPR Art.25.