Data protection by design (privacy by design) and by default requires building data protection into a product or processing activity from its design, not after the fact. It translates into minimization, pseudonymization, protective default settings and access limited to what is necessary.
Example
A form does not ask for the date of birth if it is not needed.