Data protection by design and by default is a legal requirement under the UK GDPR. It involves integrating appropriate technical and organizational measures throughout the lifecycle of systems, services, products, and business practices to effectively implement data protection principles.