Data protection by design and by default