# Data protection by design and by default 25(3) — GDPR — provision context

> Focused context for a single provision (25(3)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-25#par-3
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Data protection by design and by default** (GDPR, full article: https://overview.legal/laws/gdpr/art-25).

## Provision text

### 25(3)

An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article.


## Topics on this provision

- **Codes of Conduct** — https://overview.legal/topics/codes-of-conduct
  Industry codes of conduct for data protection
- **Accountability** — https://overview.legal/topics/accountability
  Principle of demonstrating GDPR compliance
- **Certification** — https://overview.legal/topics/certification
  Data protection certification mechanisms

## Cited by (exact-provision citations)

- **CJEU - C-205/21 - Ministerstvo na vatreshnite raboti** (case-law) — https://overview.legal/posts/158437
- **Judgment of the Court (Fifth Chamber) of 26 January 2023.#Criminal proceedings against V.S.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categ** (case-law) — https://overview.legal/posts/132297
- **Judgment of the Court (Fifth Chamber) of 26 January 2023.#Criminal proceedings against V.S.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categ** ¶50 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132297
- **Judgment of the Court (Fifth Chamber) of 26 January 2023.#Criminal proceedings against V.S.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categ** ¶28 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132297
- **CJEU - C-205/21 - Ministerstvo na vatreshnite raboti** ¶28 (case-law, GDPRhub) — https://overview.legal/posts/158437
- **Judgment of the Court (Fifth Chamber) of 26 January 2023.#Criminal proceedings against V.S.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categ** ¶40 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132297
- **CJEU - C-205/21 - Ministerstvo na vatreshnite raboti** ¶50 (case-law, GDPRhub) — https://overview.legal/posts/158437
- **CJEU - C-205/21 - Ministerstvo na vatreshnite raboti** ¶40 (case-law, GDPRhub) — https://overview.legal/posts/158437
- **Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation** (guidance) — https://overview.legal/posts/50823
- **Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020** (guidance) — https://overview.legal/posts/38054

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-25#par-3 · 2026-08-22