7.4 Privacy by design and privacy by default

Entry 7.4 requires that organizations embed privacy principles into the design of processes, systems and products from the outset and ensure that, by default, only personal data necessary for a specific purpose is collected, processed and retained, minimizing exposure and supporting compliance.