Privacy by Design Scorer

By design means before the design is fixed

Article 25 requires measures at the time of determining the means of processing, not at launch. That timing is the whole substance of the obligation: a privacy review that happens once the schema is settled and the integrations are built can only recommend changes that are now expensive, which is precisely why such recommendations get overruled. A review at design stage costs a conversation; the same review after build costs a migration, and the difference decides whether it happens.

By default is a separate and stricter requirement

Article 25(2) is not a restatement of the first paragraph. It requires that, by default, only personal data necessary for each specific purpose is processed, and that data is not made accessible to an indefinite number of people without the individual acting. A system with excellent privacy controls that ships with all of them switched off satisfies the first paragraph and fails the second, and that configuration is common because defaults are usually chosen for engagement rather than for compliance.

Privacy threat modelling asks a different question

Security threat modelling asks who could break in and what they would reach. Privacy threat modelling asks what the system does to the people in it when it works exactly as designed: what it infers, who can see it, what follows someone who leaves. A system can be secure against every attacker and still be the problem, and the two exercises produce different findings because they start from different questions.

Related tools

• SOC 2 Evidence Readiness — Interactive checklist to gauge your SOC 2 evidence readiness.
• Privacy Policy Checker — Check if your policy covers standard requirements (GDPR/CCPA basics).
• Compliance Req Finder — Find which standards (ISO, SOC2, HIPAA) apply to your industry/region.
• Audit Readiness Planner — Plan your compliance audit timeline (SOC2, ISO) backwards from deadline.