What do data protection by design and by default mean under the GDPR?

That privacy has to be built into how you set up a system and its default settings, not added after a complaint. By design means that when you choose and configure a tool, you put in place measures such as pseudonymisation, data minimisation and access control that suit the risk. By default means that, out of the box, only the personal data necessary for each purpose is processed, kept no longer than needed and not made accessible to an indefinite number of people. For a security tool, practical questions are: does it collect content or only metadata, can you limit who sees what, how long are records kept, and can people outside the security team see employees’ device names? The duty is the controller’s, so document your choices when you deploy. NetSenX’s defaults point the same way: it records metadata rather than content, never decrypts traffic, keeps alerts for the plan’s alert history, and reports AI use per device and program rather than per person; team roles are available from the Starter plan.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics