Should the privacy-by-design principle also apply to existing software?

ANSWER

Yes. This is established by EDPB Guideline 4/2019: “The obligation to maintain, review and, where necessary, update processing operations also applies to pre-existing systems. This means that legacy systems designed before the entry into force of the GDPR must be reviewed and maintained to ensure the implementation of measures and safeguards that effectively implement the principles and the rights of data subjects, as set out in these guidelines. The scope of this obligation also includes all processing operations carried out by data processors. Processor operations should be subject to regular review and assessment by controllers to ensure that they allow for ongoing compliance with principles and allow the data controller to fulfil its obligations in this respect.”