# What do data protection by design and by default mean under the GDPR?

That privacy has to be built into how you set up a system and its default settings, not added after a complaint. By design means that when you choose and configure a tool, you put in place measures such as pseudonymisation, data minimisation and access control that suit the risk. By default means that, out of the box, only the personal data necessary for each purpose is processed, kept no longer than needed and not made accessible to an indefinite number of people. For a security tool, practical questions are: does it collect content or only metadata, can you limit who sees what, how long are records kept, and can people outside the security team see employees’ device names? The duty is the controller’s, so document your choices when you deploy. NetSenX’s defaults point the same way: it records metadata rather than content, never decrypts traffic, keeps alerts for the plan’s alert history, and reports AI use per device and program rather than per person; team roles are available from the Starter plan.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/what-is-data-protection-by-design-and-by-default

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [What records of processing activities does the GDPR require us to keep?](https://netsenx.com/en/faq/what-records-of-processing-must-we-keep)
- [How do NIS2, the GDPR, DORA, the CRA and the AI Act fit together?](https://netsenx.com/en/faq/how-do-nis2-gdpr-dora-cra-and-ai-act-fit-together)
- [What is the GDPR, in plain terms?](https://netsenx.com/en/faq/what-is-the-gdpr-in-plain-terms)
- [Are IP addresses personal data under the GDPR?](https://netsenx.com/en/faq/are-ip-addresses-personal-data-under-the-gdpr)
- [What counts as a personal data breach under the GDPR?](https://netsenx.com/en/faq/what-counts-as-a-personal-data-breach)