GDPR Article 25

GDPR Article 25 codifies the principle of data protection by design and by default. Controllers must implement appropriate technical and organizational measures (such as pseudonymization) at the time of design and during processing. This is the legal hook that pulls privacy requirements down to the code level: input validation, data minimization, encryption, and access control must be present from the start, not bolted on.