Contents
Where Privacy by Design comes from
The concept was developed in the 1990s by Ann Cavoukian, then Information and Privacy Commissioner of Ontario (Canada). It rests on a simple idea: it is more effective and less costly to design a system that respects data from the outset than to fix one that does not.
The seven foundational principles
- Proactive, not reactive. Prevent privacy breaches before they happen.
- Privacy as the default. With no action from the user, their data is protected at the highest level.
- Privacy embedded into design. It is part of the system's architecture, not an added layer.
- Full functionality. Privacy and functionality are not in opposition; aim for both.
- End-to-end security. Data is protected throughout its life cycle, from collection to destruction.
- Visibility and transparency. Practices must be verifiable by users and by the authorities.
- Respect for the user. The user's interests stay at the centre: clear settings, understandable information, real choices.
What the GDPR says
Article 25 of the GDPR turns these ideas into an obligation for organisations subject to European law. It distinguishes between:
- data protection by design: putting in place, from the point at which the means of processing are determined, technical and organisational measures such as pseudonymisation or minimisation;
- data protection by default: processing by default only the data necessary for each purpose, whether in terms of the amount of data collected, the extent of the processing, the retention period or the number of people with access to it.
And in Morocco?
Law 09-08 does not mention Privacy by Design. Two of its requirements, however, lead directly to it:
- Article 3, which requires data to be adequate, relevant and not excessive in relation to the purpose, and kept only for as long as necessary;
- Article 23, which requires technical and organisational security measures.
A Moroccan organisation that applies Privacy by Design therefore finds it easier to comply with Law 09-08. It also prepares itself for the GDPR if it serves customers located in the European Union.
Applying the approach to a digital project
| Project phase | Question to ask | Example measure |
|---|---|---|
| Scoping | What data is actually needed? | Remove form fields that are not essential |
| Design | Who needs access to what? | Role-based access rights, separate environments |
| Development | How can data exposure be reduced? | Encryption, pseudonymised test data |
| Configuration | What default settings? | No pre-ticked boxes, active consent for marketing |
| Go-live | Have people been informed? | Privacy notices, privacy policy, formality filed with the CNDP (Morocco's data protection authority) |
| Operation | How long should data be kept? | Automatic deletion at the end of the retention period |
Practical checklist
- Involve a person responsible for data protection from the scoping stage of every project.
- Justify every item of data collected by a specific purpose.
- Set all default settings to the most protective level.
- Use fictitious or pseudonymised data for testing.
- Build automatic deletion of data into the design.
- File the CNDP formality before going into production.
Further reading
- 5 min read
- 4 min read
- 4 min read
Frequently asked questions
Is Privacy by Design mandatory in Morocco?
The term does not appear in Law 09-08, but its requirements on proportionality (Article 3) and security (Article 23) in practice call for a very similar approach. For an organisation subject to the GDPR, Article 25 makes it an explicit obligation.
What is the difference between Privacy by Design and Privacy by Default?
Privacy by Design concerns the design of the system as a whole. Privacy by Default is a specific application of it: default settings must be the most protective, and only the necessary data should be processed without any action by the user.
Does Privacy by Design cost more?
It takes effort at the scoping stage, but it usually costs far less than fixing a system already in production after an incident, an inspection or a complaint.
General information, not legal advice.
Report an error