Incident Readiness as Part of Privacy by Design — At the Forefront of the European Debate

[Disclaimer] This article is based on the author’s personal views, and the author is not a licensed attorney. Please note that this article is not intended to provide legal advice.

Introduction

As many of you are aware, Article 25 of the GDPR (General Data Protection Regulation) defines “data protection by design and data protection by default” and explicitly requires organizations to implement technical measures and other safeguards in accordance with the fundamental principles of data protection.

Some articles note that the “by design, by default” concept defined in Article 25 incorporates the “Privacy by Design” concept developed in 2009 by Dr. Anne Kabukian, who was serving as the Information Commissioner for the Province of Ontario, Canada, at the time. Incorporating the “Privacy by Design” concept is crucial when developing systems that take incident response into account.

What Are the Seven Principles of Privacy by Design?

"Privacy by Design" consists of seven principles, and it is used to verify, from the preliminary stages of system design, whether development is proceeding in accordance with these principles. The seven principles are as follows:

1. Not reactive, but proactive; not remedial, but preventive

   Rather than responding after a privacy breach occurs, we take proactive measures to prevent such breaches from happening in the first place.

2. Privacy by Default

   Adopt privacy protection as a standard rule and incorporate it as a mechanism that provides automatic protection

3. Privacy Built into the Design

   Instead of implementing privacy protection as an ancillary service, incorporate it as a design element from the outset during development.

4. Fully Functional — Not a Zero-Sum Game, but a Positive-Sum Game

   Rather than prioritizing either security measures or privacy protection, we aim to achieve both at the same time.

5. Security from Start to Finish — Protecting the Entire Lifecycle

   Design security and privacy protections into the entire information lifecycle

6. Visibility and Transparency — Maintaining Openness

   Ensure transparency and an intuitive design to foster an environment where users and providers can verify and trust one another

7. Respect for User Privacy — Maintaining a User-Centric Approach

   Putting the user first and maximizing individual benefits

Based on these seven principles, this approach becomes even more important for building a reliable system while protecting users' rights.

"Privacy by Design," as recommended by regulatory authorities in G7 countries, including Japan

It has been about 17 years since the seven principles of “Privacy by Design” were conceived, and the digital society envisioned at that time is gradually becoming a reality.

Until now, compliance and governance—focused primarily on meeting legal requirements—have been the central topics of discussion, and regulatory authorities in various countries have actively sought to ensure legal compliance. However, as AI gradually becomes the norm in the business environment, the importance of service design and service architecture is growing alongside compliance.

In particular, regarding services used by minors, numerous statements have been issued calling for the protection of children’s personal information. At the G7 Roundtable of Data Protection and Privacy Authorities held in Ottawa, Canada, in June 2025, a statement was issued regarding the handling of children’s personal information, stating that “regardless of whether it is legally required in a specific jurisdiction, adopting ‘privacy by design’ practices encourages businesses to act as responsible innovators.”

Since children’s personal information is more likely to be misused than other types of information in the event of a data breach, it is recommended that system development proceed in accordance with the “Privacy by Design” principle from the service design stage onward.

Furthermore, at the G7 Roundtable of Data Protection and Privacy Authorities held in Paris, France, in June of this year, in addition to “Privacy by Design”—which was encouraged in last year’s statement—the need to incorporate this principle into the design of age verification systems used to determine whether an individual is a minor was also raised.

Another statement also addressed the topic of “protecting children’s privacy in connection with internet-connected home devices,” noting that privacy protection is becoming a key consideration in product design not only for companies that provide digital services but also for hardware manufacturers.

Designing Incident Response from the Ground Up

So far, we have discussed global trends and developments regarding international rules.

While I understand the need to prioritize privacy protection from the design stage onward, I imagine many of you are wondering why we should adopt the “Privacy by Design” approach, especially when considering practical considerations.

One of the main reasons I believe we should focus on “By Design” is the corporate reporting obligations (incident reporting) required by regulations in various countries.

Recently, we have seen an increasing number of cases where companies leak personal information—and not just as a result of external attacks. When personal information is leaked, it is not enough to simply strengthen internal security and governance; companies must also establish systems to assess the extent of the leak and report on the situation promptly.

This means it is important to consider design from the perspective of the “information lifecycle” as defined by “Privacy by Design.”

Article 33 of the GDPR requires “notification of personal data breaches to supervisory authorities,” and companies must notify the relevant supervisory authority of any breach—including personal data leaks—within 72 hours. Within this short 72-hour period, companies are required to identify the problem that has occurred and prepare responses to the necessary questions before taking appropriate action.

Looking at actual cases in Europe where fines were imposed for violations of Article 33 of the GDPR, a list of penalty cases known as the “Enforcement Tracker” states that 101 cases (including violations of provisions other than Article 33) were subject to penalties between the GDPR’s entry into force in 2018 and April 30, 2026.

As such, if development is not carried out with incident response in mind from the system design stage onward, there may be delays in complying with reporting obligations, and in some cases, this can even result in fines.

First, try conducting a risk assessment of the personal information your company handles.

I imagine many of you are wondering exactly how your company should implement “Privacy by Design.” The seven principles outlined in “Privacy by Design” are somewhat abstract, so there are many aspects that can be difficult for practitioners to grasp.

Therefore, we recommend that you begin by conducting the DPIA (Data Protection Impact Assessment) required under Article 35 of the GDPR.

*In Japan, the Personal Information Protection Commission published a document on June 30, 2021, outlining points to consider regarding PIA (Privacy Impact Assessment), which is one of the methods for implementing “Privacy by Design.”

A DPIA is a process used when personal data processed under the GDPR is classified as high-risk; it involves assessing potential risks in advance, compiling the results of that assessment into a report, and maintaining a record of it.

In April of this year, the EDPB (European Data Protection Board), which includes regulatory authorities from various European countries, released a DPIA template and published the criteria that should be evaluated when conducting a DPIA.

The template includes items for evaluating whether “data protection by design and data protection by default”—as defined in Article 25—have been implemented. As a first step, we will verify, in accordance with this template, whether measures corresponding to “by design” have been implemented.

While following the template, we will evaluate whether the "By Design" requirements are being met by comparing them against the following criteria.

(The following is an example of a risk assessment conducted in accordance with the template for the items defined in Article 25.)

Evaluation Criteria: Criteria defined in Article 25 of the GDPR

Features that comply: Features that have been implemented to meet the requirements defined in Article 25 of the GDPR, or features that are scheduled to be implemented in the future.

Suitability Assessment: An explanation of the reasons why the implemented or planned feature was assessed as suitable for meeting the criteria.

Implementation Status: Status of Feature Implementation

Referring to the examples provided here, you should first conduct a risk assessment to determine whether the specifications meet the “by design” requirements set forth in Article 25, and then fill out the evaluation criteria accordingly. You should also clearly state the current implementation status and assess the severity of potential risks.

For features that have not yet been implemented but are under consideration for future implementation, we will also provide details on the schedule and plans leading up to their implementation. By completing each item, you can identify gaps in specific services or products and appropriately assess risks related to personal information within the organization.

Understand where high-risk data is located within your own company

So far, we have introduced a method for using a risk assessment template to verify whether “By Design” requirements have been implemented. By organizing the requirements that need to be implemented in advance according to their risk levels, you can minimize the potential impact of risks that may arise after the system goes live.

On the page published by the European Commission regarding this approach, it is referred to as a “risk-based approach,” which requires organizations to assess in advance the risks involved in processing personal data within their systems and to identify potential risks in a transparent manner.

Even if an incident occurs—such as a personal data breach caused by system flaws or vulnerabilities, or a suspected case of unauthorized use—adopting a risk-based approach enables rapid risk detection and ensures that reports can be submitted to the relevant regulatory authorities within the limited timeframe of 72 hours.

In implementing this “risk-based approach,” companies need to understand what types of data they handle and how much data they process.

One approach to achieving this is the concept of “data mapping,” and we recommend starting by implementing this “data mapping.” The “Data Mapping Toolkit” published by the Personal Information Protection Commission in October 2022 provides an easy-to-understand explanation of the significance of “data mapping” and how to implement it.

In this article, we have outlined the steps companies should take from the perspective of “Privacy by Design.” In particular, when it comes to incident response in the event of a data breach, it is becoming increasingly important to conduct risk assessments by anticipating incident risks as early as the system design phase—rather than waiting until a problem occurs to determine how to respond. We hope this serves as a useful reference as you consider practical countermeasures.

Reference Materials

• Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

• The Seven Fundamental Principles of Privacy by Design

• Statement on Promoting Responsible Innovation Through a Privacy-First Approach and Protecting Children

• Statement on Age Verification with a Focus on Privacy Protection

• G7 Roundtable of Data Protection and Privacy Authorities: Communiqué

• Enforcement Tracker

• Promoting PIA Initiatives — The Significance of PIA and Key Considerations Based on Implementation Procedures —

• Enhancing Compliance and Consistency: EDPB Adopts DPIA Template

• Application of the GDPR

• Data Mapping Toolkit