Privacy by default means that personnel should be trained to handle Personal Information and implement procedures to ensure that each time Personal Information is processed, appropriate technical and organizational measures are taken for ensuring that, by default, only Personal Information which is necessary for each specific purpose is processed (in terms of amount of data processed, extent of the processing and data retention) and is made accessible only to a limited number of persons who need to know.