Privacy

Privacy by Default vs Privacy by Design: What's the Difference?

Privacy by design means building data protection into a product from the start. Privacy by default means the most protective setting is the one you get without changing anything. Design is the philosophy; default is one of the outcomes it has to produce. Both are duties under GDPR Article 25.

Privacy by design means building data protection into a product from the start, across its whole life. Privacy by default is the narrower rule inside it: the most privacy-protective option is the one you get without changing a setting. Design is the philosophy. Default is one of the outcomes it has to produce.

Both are legal duties under GDPR Article 25, and both started as ideas long before they were law.

Privacy by design: how the thing is built

Privacy by design asks a question at the beginning of a project, not the end: how do we build this so people's data is protected without anyone having to remember to protect it? It's proactive, and it covers the whole lifecycle, from collection to deletion. The idea comes from Ann Cavoukian's seven foundational principles and is now written into GDPR Article 25(1).

A concrete example: a system where the server never receives readable data is private by design. The protection lives in the architecture, not in a policy someone has to follow.

Privacy by default: what happens if you do nothing

Privacy by default is easier to test. Take any product, change nothing, and look: are you already protected, or do you have to go find the privacy settings and switch them on?

Article 25(2) puts it plainly: by default, only the data necessary for a specific purpose should be processed. The safe option is meant to be the automatic one, not a reward for reading the settings page.

Why the difference matters

A product can pass one and fail the other. Strong architecture with careless defaults, where everything is shared openly until you lock it down, is well designed but not private by default. Good defaults sitting on a leaky design protect you right up until the design gives way. You want both, and knowing which one a tool is missing tells you where its risk is.

So when a company says it takes privacy seriously, ask two questions. By design: was privacy a starting constraint or a late bolt-on? By default: does the safe option happen on its own?

Where doconvoy fits

doconvoy shows both halves. The architecture is the by-design part: content is encrypted before it reaches the server, so doconvoy can't read it, and that protection is in how the product is built rather than a promise. Mandatory expiry is a by-default part: every request expires unless you extend it. To be precise, "by default" here means your content is private and time-limited from the start. Tighter controls like passcodes and allow-lists are there to switch on when a job needs them.

Related: What does "privacy-first" actually mean? · The best way to protect sensitive data is not to have it · Why doconvoy can't read your data · GDPR-sensitive data workflows

Common questions

Are privacy by design and privacy by default the same thing?

No. Privacy by design is the broader idea of building data protection into a product across its whole lifecycle. Privacy by default is a specific requirement within it: if the user changes nothing, the most privacy-protective option is already in force. Both are legal duties under GDPR Article 25.

What does GDPR Article 25 require?

Article 25(1) requires data protection to be built into processing from the design stage ('by design'). Article 25(2) requires that, by default, only the personal data necessary for each specific purpose is processed ('by default').

What does 'by default' actually cover?

The European Data Protection Board reads it across four dimensions the default should minimise: the amount of data collected, the extent of its processing, how long it's stored, and who can access it.