Data Protection Principles

Collect with a defined purpose

Organizations should understand why they need personal information and avoid collecting more than necessary. Notice and lawful basis requirements depend on the relevant jurisdiction.

Protect information throughout its lifecycle

Use proportionate access controls, secure transfer and retention rules. Document processes for correcting or deleting information where required.

Review suppliers and incidents

Third-party services can affect privacy obligations. Assess processor arrangements and maintain a process for identifying and responding to incidents.

Practical review checklist

• Define the business objective and the owner accountable for decisions.
• Document the current position and relevant dependencies.
• Assess security, operational and legal implications before making changes.
• Set measurable outcomes and a date to review results.
• Maintain records of approvals, exceptions and lessons learned.

These are general considerations; the appropriate approach depends on the organization, sector and applicable requirements.

Related resources