Data Management Tools (DMTs) play a crucial role in today’s data-driven society, but they also entail certain problems related to compliance with the regulation on personal data protection. With regard to this matter, in the past years, the European legislator has initiated a process, which is still ongoing, of profound innovation, which will continue to evolve in terms of data governance. This contribution provides some critical observations on the application of Article 25 GDPR, in the matter of privacy by design and by default, on DMTs, highlighting some problem areas the regulation in question includes in terms of application.