# GDPR Art.25

URL: /systems/trust-and-governance/criteria/gdpr/art-25 · Id: `criterion:gdpr:Art.25`

> A controller builds data protection into processing by design and processes only necessary data by default.

A controller builds data protection into processing by design and processes only necessary data by default.

| Property | Value |
| --- | --- |
| Framework | GDPR |
| Reference | `Art.25` |
| Satisfied by | [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation) |