Privacy by design treats privacy as a core design requirement rather than a fix added after deployment. It identifies risks early, minimizes data use, and applies protective defaults throughout a technology’s lifecycle. For large language models (LLMs), this means addressing privacy from training-data preparation through deployment and later evaluation. section 3.4
A privacy-by-design approach for LLMs can include:
- Curating training data to remove sensitive information. section 3.4
- Using privacy-enhancing techniques during preprocessing and training. section 3.4
- Evaluating models for unintended memorization and documenting the privacy measures used. section 3.4
- Setting privacy protections by default and treating accountability as an ongoing responsibility. section 3.4 section 3.14
Privacy by design is also a legal obligation in the European Union under Article 25 of the General Data Protection Regulation (GDPR), which requires data protection by design and by default. Compliance expectations differ internationally: Brazil’s LGPD and China’s PIPL emphasize related protections, while the United States has traditionally relied more on sector-specific notice and choice. section 3.4 section 3.14
Figure 3.4 A timeline of data protection laws
Browse the timeline to place privacy by design within the development of modern data-protection laws. section 3.14


