Seven principles,
and the evidence for each.

Lawful means you have one of the six bases in Article 6 for each purpose, and meet any other law that applies. Fair means you do not use data in ways people would not reasonably expect or that harm them unjustifiably, even where a basis exists. Transparent means telling people, at the time you collect their data, who you are, why you want it and what they can do about it. A cookie banner that loads analytics before anyone clicks is a common way to fall short here, and of the ePrivacy rules on cookies. See our consent guide.

Decide and write down why you collect each piece of data before you collect it. Further use is allowed only where it is compatible with the original purpose; archiving in the public interest, research and statistics are treated as compatible under Article 89(1) safeguards. A new purpose that is not compatible needs its own basis, and usually a new notice. Training a model on support tickets collected to answer support questions is a question you should ask before, not after.

Data minimisation means personal data must be adequate, relevant and limited to what is necessary for the purpose (Article 5(1)(c)). Necessary is the operative word: not useful, not possibly useful later. In practice:

• Justify each field on each form. If you cannot say what a date of birth is for, stop asking for it.
• Default to less: pseudonymise analytics, truncate IP addresses, collect an age band rather than a birth date where that is enough.
• Limit who can see the data as well as how much is collected; Article 25(2) counts accessibility as part of minimisation.
• Check third-party scripts. A tag that sends full page URLs with email addresses in query strings is a minimisation failure you did not write.

Accuracy requires every reasonable step to correct or erase inaccurate data without delay, having regard to the purpose; the right to rectification in Article 16 is the person's side of the same duty. Storage limitation is the GDPR's data retention rule: keep data in identifiable form only as long as the purpose needs it. The GDPR sets no fixed periods. You set them, write them in a retention schedule, and then actually delete or anonymise on time. Other law often sets a minimum, such as tax records, and that is a legitimate reason to keep data longer for that purpose only.

Article 5(1)(f) requires appropriate security, and Article 32 says what appropriate means: measures matched to the risk, such as pseudonymisation and encryption, resilience, the ability to restore access after an incident, and regular testing. If you already run SOC 2 or ISO 27001 controls, most of the work is done; the gap is usually mapping it to personal data and having a breach process that meets the 72-hour notification rule in Article 33. See incident management.

Accountability turns the principles from intentions into evidence. Article 5(2) makes the controller responsible for compliance and able to demonstrate it, and Article 24 requires appropriate measures, including policies, to do so. The documents a regulator or enterprise customer will ask for: a record of processing activities, privacy notices, consent records, processor contracts, DPIAs, a breach log, training records and the results of your own checks. If it is not written down, it will be hard to show it happened.

Article 25 makes the principles an engineering requirement. By design (Article 25(1)): both when you decide how to process data and while you process it, implement appropriate technical and organisational measures, such as pseudonymisation, designed to put the principles into effect, taking into account the state of the art, cost, the nature and purpose of the processing and the risks. By default (Article 25(2)): only the data necessary for each specific purpose is processed, and that applies to how much you collect, how far you process it, how long you keep it and who can access it. By default, personal data must not be made accessible to an indefinite number of people without the individual's intervention.

The EDPB's Guidelines 4/2019 are the EU reference on what this means in practice. In the UK, the Data (Use and Access) Act 2025 adds that online services likely to be used by children must take children's needs into account, and the ICO has updated its by-design guidance to match. Article 25 sits in the lower fine tier of Article 83(4): up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher.

The phrase predates the GDPR. Ann Cavoukian, as Information and Privacy Commissioner of Ontario, set out seven foundational principles that many teams still use as a design checklist: proactive not reactive, preventative not remedial; privacy as the default setting; privacy embedded into design; full functionality, positive-sum not zero-sum; end-to-end security across the whole lifecycle; visibility and transparency; and respect for user privacy. They are a framework, not law. The legal duty in the EU and UK is Article 25, and that is what you will be assessed against.