Privacy by design & by default assessment