Data protection by design and by default is about considering data protection and privacy at the start of everything you do. It will help you comply with the UK GDPR’s fundamental principles and requirements, including accountability.

• You must put in place appropriate technical and organisational measures to implement the data protection principles effectively and safeguard people’s rights.
• This means you must integrate data protection into your processing activities and business practices, from the design stage and throughout the lifecycle.
• If you provide online services likely to be accessed by children, you must consider their needs when you’re thinking about which technical and organisational measures are appropriate.
• This is the ‘children’s higher protection matters’ duty.