OneTrust Certified Privacy Professional Practice Exam

TRUE OR FALSE: The GDPR requires organizations to implement measures that ensure data protection by design and by default.

1. True

2. False

3. Depends on Organization Size

4. Only for Data Controllers

The correct answer is: True

The statement is true because the General Data Protection Regulation (GDPR) indeed mandates that organizations implement data protection measures that ensure data protection by design and by default. This principle is outlined in Article 25 of the GDPR, which emphasizes that data protection should be integrated into the development of business processes for products and services. By design means that data protection should be a fundamental part of the processing activity from the outset, ensuring that privacy considerations are built into the system rather than tacked on after the fact. By default reinforces this mandate by requiring that the default settings of systems should be configured to the highest privacy settings, ensuring that only necessary personal data is processed and that participants’ privacy rights are respected automatically without the need for manual intervention. The requirement applies universally to organizations that process personal data—there is no exemption based on the size of the organization or whether they operate as data controllers or processors. This commitment is designed to foster a privacy-aware culture within organizations and to enhance the protection of individuals' personal data throughout its lifecycle.