GDPR and US privacy law requires that businesses implement privacy by design in their environment, but what does that mean and what are some examples?