Data protection by design means privacy safeguards have to be built into a system from the very start of development, not added on afterwards as an afterthought.