The growing reliance on data has required leading brands to take Data Privacy seriously. AdTech and MarTech companies – commonly referred to as controllers and processors within the EU’s GDPR are now required to have Data Protection by ‘Design and by Default’. Data Protection by Design is a proposed new approach that ensures privacy and data protection compliance measures are introduced and integrated within the software at the production stage itself.  

What is Data Protection by Design?  

The concept originates from Article 25 of the GDPR and advocates two initiatives that must be proactively incorporated by MarTech and AdTech companies. The regulation highlights two aspects…

• Active and effective implementation of technical and organizational measures such as pseudonymization that is designed to secure data protection principles. 
• Technical and organizational measures to process only that data that is necessary.

Data Protection by Design and Default focuses on the processing of data, requiring systems and processes to be created with consideration of data protection as early as the design stage. To further interpret, privacy measures must be incorporated within the system that is processing this data. A common example of pseudonymization is to encrypt data from its source to destination, this ensures limited access or visibility of the data while being processed or when in transit.

Data Protection by Default

‘By Default,’ signifies only the data that is necessary is processed. For instance – web searches, keywords entered, and Add to Carts, this information is not stored by the engine by default. Also, the amount of data being collected, the scope of processing, and the storage and access must be minimized to the bare minimum.  

How can marketers and advertisers align with Data Protection by Design and Default? 

The idea of adopting ‘Data protection by Design and Default’ allows a sense of relief and composure to otherwise confused marketers. It helps put your mind at ease concerning whether your data effort is aligned with the right compliance. Every company that collects user data is required to assess these parameters and compliance will be responsible for implementing these policies.

Compliance comes down to taking the following steps:

• Use a template for privacy-impact assessment (PIA) whenever a business design, procures or implements a new system
• Keep standard contracts up-to-date with data processors to assess the distribution of liabilities between the parties concerning the “data protection by design” and “privacy by default” requirements.
• Revisit and analyze data-collection forms and web pages to ensure excessive data is not collected
• Implementing automated deletion processes for particular personal data, as well as technical measures to ensure that personal data is set for deletion after a particular period

Benefits of Data Protection by Design

• Adopting these procedures is essential because…  
• It minimizes risk and increases trust 
• Identify issues with processing data early and address them effectively 
• Increased awareness and compliance with privacy obligations 
• Achieve a lower privacy intrusion in your efforts

The entire effort aims to set certain ‘rules of thumb,’ concerning user privacy, consent, and overall data collection. These efforts bring in a more mature and responsible approach. While there is a constant debate around subjects that are close to this, eventually companies will find it difficult to ignore their responsibility and will have to align as the situation calls for a universal code of conduct.