What it means
Privacy by design means building data protection into a system from the start, through its architecture, defaults and processes, rather than adding it at the end. Under the GDPR, data protection by design and by default is a legal requirement.
Real-world example
A health insurer designs an AI assistant for customer service staff. It removes or masks personal identifiers before text is sent to the model, sets logs to delete conversation content after 30 days, gives each staff member access only to their own cases, and makes the most privacy-protective settings the default.
Why it matters for AI adoption
Designing privacy in early is usually cheaper and more effective than fixing problems after launch. For AI, it means questioning which data the system really needs, where it flows, how long it is kept and who can see it, at every stage of the design.
Questions to ask
- What is the minimum personal data this system needs to work?
- Where does personal data flow, how long is it kept, and who can access it?