# Data protection by design and by default 25(1) — GDPR — provision context

> Focused context for a single provision (25(1)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-25#par-1
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Data protection by design and by default** (GDPR, full article: https://overview.legal/laws/gdpr/art-25).

## Provision text

### 25(1)

Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.


## Topics on this provision

- **Anonymization** — https://overview.legal/topics/anonimisering
  Irreversible removal of identifying information from data
- **Retention Period** — https://overview.legal/topics/bewaartermijn
  The duration for which personal data may be stored
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Judgment of the Court (Grand Chamber) of 6 October 2020.#État luxembourgeois v B and Others.#Requests for a preliminary ruling from the Cour administrative (Luxembourg).#References for a preliminary ruling – Directive 2011/16/EU – Administrative cooperation in the field of taxation – Articles 1 and 5 – Decision ordering that information be provided to the competent authority of a Member State, acting in response to a request for exchange of information from the competent authority of another Mem** (case-law) — https://overview.legal/posts/132329
- **Judgment of the General Court (Fourth Chamber) of 20 July 2016 (Extracts).#Athanassios Oikonomopoulos v European Commission.#Non-contractual liability — Damage caused by the Commission in the context of an OLAF investigation and by OLAF — Actions for damages — Action for a declaration that certain measures taken by OLAF were void and inadmissible for evidentiary purposes before the national authorities — Admissibility — Misuse of powers — Processing of personal data — Rights of the defence.#Case** (case-law) — https://overview.legal/posts/132355
- **Judgment of the Court (Fifth Chamber) of 26 January 2023.#Criminal proceedings against V.S.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categ** (case-law) — https://overview.legal/posts/132297
- **Judgment of the Court (Eighth Chamber) of 25 February 2021.#European Commission v Kingdom of Spain.#Failure of a Member State to fulfil obligations – Article 258 TFEU – Directive (EU) 2016/680 – Processing of personal data – Prevention, investigation, detection or prosecution of criminal offences – Failure to transpose and notify the transposition measures – Article 260(3) TFEU – Application for the imposition of a lump sum and a penalty payment.#Case C-658/19.** (case-law) — https://overview.legal/posts/132325
- **Judgment of the Court (Second Chamber) of 15 March 2017.#Tele2 (Netherlands) BV and Others v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Directive 2002/22/EC — Article 25(2) — Directory enquiry services and directories — Directive 2002/58/EC — Article 12 — Directories of subscribers — Making available personal data concerning subscri** (case-law) — https://overview.legal/posts/132349
- **Data Protection Commissioner v. Schrems and Facebook** (case-law) — https://overview.legal/posts/6146
- **Deutsche Wohnen SE v Staatsanwaltschaft Berlin** (case-law) — https://overview.legal/posts/51487
- **Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) –** (case-law) — https://overview.legal/posts/132130
- **Data Protection Commissioner v Facebook Ireland and Maximillian Schrems** (case-law) — https://overview.legal/posts/51470
- **Judgment of the General Court (Eighth Chamber, Extended Composition) of 27 April 2022.#Robert Roos and Others v European Parliament.#Public health – Requirement to present a valid EU digital COVID-19 certificate to access the Parliament’s buildings – Legal basis – Freedom and independence of Members of the European Parliament – Obligation to ensure the health of staff in the service of the European Union – Parliamentary immunity – Processing of personal data – Right to respect for private life –** (case-law) — https://overview.legal/posts/132313
- **Maximillian Schrems v Data Protection Commissioner** (case-law) — https://overview.legal/posts/51471
- **Cour Administrative - 49701C** (case-law) — https://overview.legal/posts/158440

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-25#par-1 · 2026-08-22