What does privacy by design mean architecturally rather than as a policy statement, and which decisions must be made first?

What it means architecturally

• Data minimisation as a design constraint: collect what is needed for a stated purpose and nothing else. Every additional field is a permanent obligation — retention, access control, deletion, breach exposure — and the cheapest data to protect is the data not collected.
• Purpose limitation enforced structurally, so data collected for one purpose is not available for another by default. That means separate stores or enforced access policy rather than one dataset everyone reads.
• Privacy-protective defaults, since defaults determine the outcome for the overwhelming majority of users.
• Separation of identity from records, which is what allows retention and erasure obligations to coexist.
• Deletion designed as a capability, propagating to every derived copy with completion tracked rather than assumed.

The decisions that must be made first

The ones that are expensive to reverse:

• Whether identity is separable from the records, which if retrofitted means rewriting nearly every table.
• The lawful basis per purpose, because a purpose based on consent needs enforcement machinery and one based on contract does not — and changing the basis later is a legal and technical migration.
• Jurisdiction and residency as first-class data dimensions, since retrofitting a partition key into a live schema is among the genuinely painful migrations.
• What is logged, because logs are where personal data most often leaks and are then retained, replicated to analytics, and read by many people — and a logging design that captures everything by default is one that must later be audited statement by statement.

What is not privacy by design

A privacy policy, a consent banner, and an annual review. Those are compliance artefacts, and a system that collects everything, logs everything and retains indefinitely satisfies all three while being maximally exposed.

The test to apply to a new feature

What data does this collect, for what purpose, under what basis, for how long, who can see it, and how is it deleted? Five questions, answerable in a design review, and a feature that cannot answer them has deferred the obligation rather than avoided it — which is how an estate acquires data nobody can account for.