A Privacy by Design strategy  isn't just a mitigating factor under GDPR, it's good business. 

Security is improved by reducing the threat surface and privacy is guaranteed because data is only accessible for permitted uses or legitimate interests.

The PrivOps Matrix makes it easy to anonymize, mask or pseudonymize (also described as de-identification or tokenization) sensitive data with minimal impact to existing applications.

Additional Example: Pseudonymized Read

Here's an example of how requesting users and applications are able to access only the sensitive information as they're allowed based on policy.  Since permitted uses are also automated, expanding or limiting access to sensitive personal data happens in real time.