Privacy by Default

Under the DPDP Act, privacy by default refers to the practice of designing systems, processes, and services in a way that automatically applies appropriate privacy protections without requiring individuals to manually enable them.

For organizations processing personal data, privacy by default means limiting data collection, access, sharing, and retention to what is necessary for the stated purpose. It encourages Data Fiduciaries to build privacy considerations into operational processes so that individuals receive stronger protection from the beginning of a data processing activity.

The DPDP Act does not specifically define or require the term “privacy by default.” However, adopting privacy-by-default practices supports key obligations under the Act, including purpose limitation, data minimisation, security safeguards, and responsible processing of personal data.

Examples of privacy-by-default practices include limiting default data collection fields, restricting unnecessary access permissions, setting appropriate retention periods, and ensuring privacy-friendly configurations in applications and platforms.

In practice, gaps emerge when:

• Applications collect more personal data than required by default.
• Users must manually change settings to improve privacy protection.
• Access permissions are broader than necessary.
• Default retention settings result in unnecessary data storage.
• Privacy considerations are introduced only after systems are built.

Organizations address these challenges by embedding privacy controls into product design, reviewing default configurations, applying access restrictions, minimizing data collection, and establishing governance processes. Within Privy, capabilities such as consent management, data discovery, privacy workflows, and compliance reporting help organizations operationalize privacy practices.