AI Governance Engineer
GitHub

GDPR Art. 5(1)(c) and 25: minimisation and data protection by design and by default

Adequate, relevant and limited data, with technical and organisational measures built in at design and set by default

By Reviewed

From clause to evidenceThe chain from GDPR Art. 5(1)(c) and 25 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: General Data Protection Regulation (EU) 2016/679, Art. 5(1)(c) and 25ClauseGDPRArt. 5 and 25Duty holder: ControllerDuty holderControllerApplies from: 2018-05-25 (In force)Applies from2018-05-25In forceArtefact: Feature justification record; PII and special-category filters; retention as codeArtefactFeaturejustification…Layers: Layer 01 Govern-as-Code and Layer 03 Evals & Red Teaming as EvidenceLayersLayer 01Layer 03Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence recordv1Same topic elsewhere: no crosswalk topic files this clause yetAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from GDPR Art. 5(1)(c) and 25 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: General Data Protection Regulation (EU) 2016/679, Art. 5(1)(c) and 25ClauseGDPR · Art. 5 and 25Duty holder: ControllerDuty holderControllerApplies from: 2018-05-25 (In force)Applies from2018-05-25 · In forceArtefact: Feature justification record; PII and special-category filters; retention as codeArtefactFeature justification recordLayers: Layer 01 Govern-as-Code and Layer 03 Evals & Red Teaming as EvidenceLayersLayer 01Layer 03Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence record v1Same topic elsewhere: no crosswalk topicfiles this clause yetAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-GDPR-ART25. Drawn from chapter 08.
Text alternative
  • Clause: GDPR, Art. 5 and 25.
  • Duty holder: Controller.
  • Applies from: 2018-05-25, In force.
  • Artefact: Feature justification record.
  • Layers: Layer 01, Layer 03.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • No crosswalk topic files this clause yet.
When this obligation appliesThe date of AIGE-OBL-GDPR-ART25 on a time axis, against its review date 2026-09-24.Earlier2024202620282030As of 2026-09-242018-05-25 · In force2018-05-25 · In forceSource: Obligation register(chapter 08)
When this obligation appliesThe date of AIGE-OBL-GDPR-ART25 on a time axis, against its review date 2026-09-24.2018-05-25 · In force2024202620282030EarlierAs of 2026-09-242018-05-25 · In forceSource: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-GDPR-ART25
DateStepDetail
2018-05-25In force
Id
AIGE-OBL-GDPR-ART25
Instrument
General Data Protection Regulation (EU) 2016/679 law
Clause
Art. 5(1)(c) and 25
In scope
Controller
Authority
National data protection authority
Applies from
In force

The artefact that evidences it

Feature justification record; PII and special-category filters; retention as code.

Patterns that build it

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

Source

Chapter 08, section The GDPR, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). GDPR Art. 5(1)(c) and 25: minimisation and data protection by design and by default (AIGE-OBL-GDPR-ART25). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art25. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{GDPR Art. 5(1)(c) and 25: minimisation and data protection by design and by default (AIGE-OBL-GDPR-ART25)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art25},
  note         = {Version 0.5.0}
}