In short. GDPR Article 25 requires controllers to build privacy safeguards into processing and limit default collection, use, retention and access to what each purpose requires.
Definition: Article 25 of the General Data Protection Regulation (GDPR) requires controllers, the people or organisations deciding why and how personal data are processed, to build data protection into processing and restrict default processing to what each specific purpose requires. Personal data are information relating to an identified or identifiable individual.
Key facts
- GDPR Article 25(1) and (2) require safeguards during design and operation, with defaults limiting collection, processing, storage and accessibility.
- The European Data Protection Board's Guidelines 4/2019, adopted on 20 October 2020, say controllers should assess third-party software and switch off functions lacking a legal basis or conflicting with intended purposes.
- As of 17 October 2026, Matomo's tracking consent guide documents a
requireConsentsetting that withholds tracking requests and cookies until consent is given.
Who sets the defaults, and when?
GDPR Article 4(7) defines the controller as the person or body determining the purposes and means of processing. Article 4(2) defines processing broadly, including collection, storage, use, disclosure and erasure.
Article 25(1) requires appropriate technical and organisational measures both when deciding how processing works and during processing itself. The assessment considers the state of the art, implementation costs, processing context and risks to people's rights. Data minimisation, defined in Article 5(1)(c), means keeping personal data adequate, relevant and limited to what the purposes require. Article 24(1) also requires measures to be reviewed and updated where necessary.
Which settings must be limited by default?
GDPR Article 25(2) sets out four dimensions of default protection:
- The amount of personal data collected must be necessary for each specific purpose.
- The extent of processing must be limited to what that purpose requires.
- The storage period must reflect that necessity.
- Accessibility must also be limited; personal data must not become accessible to an indefinite number of people without the individual's intervention.
The EDPB guidelines explain that unnecessary categories or excessive detail must be excluded from collection. They also require access controls across the data flow, with access assessed according to necessity. These requirements apply to organisational arrangements, including staff access, as well as software settings.
What does a collection control look like in analytics?
For a consent-based analytics setup, Matomo's tracking consent guide instructs the site operator to place this line at the top of the existing Matomo tracking code on every page:
_paq.push(['requireConsent']);
Once executed, this setting prevents Matomo tracking requests and cookies until consent is given. The separate requireCookieConsent setting permits tracking requests while withholding cookies. The guide documents setConsentGiven for signalling consent held in the site's own system; that method must be called on every page because it does not remember consent on subsequent requests.
The lawful basis remains a separate requirement: GDPR Article 6(1) sets the conditions for lawful processing. Article 25(2) additionally requires necessity limits for collection, processing, retention and access.
Related terms
FAQ
Does Article 25 apply to a small business website?
Yes, when the business acts as a controller for processing covered by the GDPR. The EDPB guidelines expressly include small businesses and say implementation complexity varies with the processing operation.
Can a pre-ticked box establish consent?
GDPR Recital 32 states that silence, pre-ticked boxes and inactivity do not constitute consent. Article 4(11) requires a freely given, specific, informed and unambiguous indication through a statement or clear affirmative action.
What happens when stored personal data are no longer needed?
The EDPB guidelines require deletion or anonymisation by default when personal data are no longer necessary for the processing purpose. They call for systematic deletion or anonymisation procedures embedded in processing.
Sources
- European Parliament and Council, "Regulation (EU) 2016/679 (General Data Protection Regulation)", 27 April 2016
- European Data Protection Board, "Guidelines 4/2019 on Article 25 Data Protection by Design and by Default", 20 October 2020
- Matomo, "Tracking & Cookie Consent: Integrate", undated
Check how a page reads to answer engines. Open the GEO score analyzer