# Data protection by design and by default 25(2) — GDPR — provision context

> Focused context for a single provision (25(2)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-25#par-2
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Data protection by design and by default** (GDPR, full article: https://overview.legal/laws/gdpr/art-25).

## Provision text

### 25(2)

The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.


## Topics on this provision

- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Judgment of the Court (Second Chamber) of 15 March 2017.#Tele2 (Netherlands) BV and Others v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Directive 2002/22/EC — Article 25(2) — Directory enquiry services and directories — Directive 2002/58/EC — Article 12 — Directories of subscribers — Making available personal data concerning subscri** (case-law) — https://overview.legal/posts/132349
- **Maximillian Schrems v Data Protection Commissioner** (case-law) — https://overview.legal/posts/51471
- **Judgment of the Court (Fourth Chamber) of 4 October 2024.#Maximilian Schrems v Meta Platforms Ireland Limited.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Online social networks – General terms of use relating to contracts concluded between a digital platform and a user – Personalised advertising – Article 5(1)(b) – Principle of purpos** (case-law) — https://overview.legal/posts/132159
- **Judgment of the Court (Fifth Chamber) of 24 February 2022.#SIA 'SS' v Valsts ieņēmumu dienests.#Request for a preliminary ruling from the Administratīvā apgabaltiesa.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 2 – Scope – Article 4 – Concept of ‘processing’ – Article 5 – Principles relating to processing – Purpose limitation – Data minimisation – Article 6 – Lawfulness of processing – Proc** (case-law) — https://overview.legal/posts/132316
- **CJEU - C-543/09 - Deutsche Telekom** (case-law) — https://overview.legal/posts/125605
- **Cour Administrative - 49701C** (case-law) — https://overview.legal/posts/158440
- **Supreme Court upholds €300,000 fine against INPS for GDPR violations in COVID bonus data** (case-law) — https://overview.legal/posts/53097
- **Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) –** (case-law) — https://overview.legal/posts/132130
- **Data Protection Commissioner v Facebook Ireland and Maximillian Schrems** (case-law) — https://overview.legal/posts/51470
- **Judgment of the Court (Grand Chamber) of 22 November 2022.#WM and Sovim SA v Luxembourg Business Registers.#Requests for a preliminary ruling from the Tribunal d'arrondissement de Luxembourg.#Reference for a preliminary ruling – Prevention of the use of the financial system for the purposes of money laundering or terrorist financing – Directive (EU) 2018/843 amending Directive (EU) 2015/849 – Amendment to Article 30(5), first subparagraph, point (c), of Directive 2015/849 – Access for any member** (case-law) — https://overview.legal/posts/132303
- **Judgment of the Court (Second Chamber) of 15 March 2017.#Tele2 (Netherlands) BV and Others v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Directive 2002/22/EC — Article 25(2) — Directory enquiry services and directories — Directive 2002/58/EC — Article 12 — Directories of subscribers — Making available personal data concerning subscri** ¶31 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132349
- **Judgment of the Court (Second Chamber) of 15 March 2017.#Tele2 (Netherlands) BV and Others v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Directive 2002/22/EC — Article 25(2) — Directory enquiry services and directories — Directive 2002/58/EC — Article 12 — Directories of subscribers — Making available personal data concerning subscri** ¶26 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132349

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-25#par-2 · 2026-08-22