Privacy-by-design is the practice of building data protection into a system from the first design decisions, instead of trying to fix privacy problems after deployment. It usually means collecting only the data that is needed, limiting access, setting short retention periods, and making security controls such as encryption, logging, and consent flows part of the default architecture.
In cyber security, this matters because many privacy failures come from design choices, not just breaches. Over-collected data, weak vendor controls, or poorly separated user roles can turn a normal platform into a rich target for abuse, profiling, or large-scale exposure. Defenders use privacy-by-design to reduce the blast radius of compromise, especially in sensitive environments like education, healthcare, and finance, where personal data can be misused even when no attacker breaks in.