Privacy by design means building data protection into your systems from the start, rather than adding it later as an afterthought. This is a legal requirement under UK GDPR and a best practice under US law. For example, if you're building a customer app, you should collect only the data you actually need and set privacy settings to "private" by default, not "public." This clause typically requires you to conduct impact assessments before launching new systems and to document your privacy decisions. The benefit is that you avoid expensive fixes later and reduce the risk of data breaches.
Accept this clause—it protects both parties and is now standard legal practice. However, negotiate for flexibility in *how* you implement it; the clause should describe the outcome (privacy-protective systems) rather than dictating specific technical methods. Ask for a reasonable timeline to implement privacy by design in existing systems, since retrofitting is expensive. ---
Frequently Asked Questions
What does this clause mean in simple terms?
Privacy by design means building data protection into your systems from the start, rather than adding it later as an afterthought.
Why should I care about this clause?
This is a legal requirement under UK GDPR and a best practice under US law.
What are my options?
For example, if you're building a customer app, you should collect only the data you actually need and set privacy settings to "private" by default, not "public." This clause typically requires you to conduct impact assessments before launching new systems and to document your privacy decisions.
How does this affect small businesses?
The benefit is that you avoid expensive fixes later and reduce the risk of data breaches.