P3.1
Points of Focus
Limits the Collection of Personal Information [P][C]
The collection of personal information is limited to that necessary to support the achievement of the entity's objectives.
Collects Information by Fair and Lawful Means [P][C]
Methods of collecting personal information are reviewed by management before they are implemented to confirm that personal information is obtained- (a) fairly, without intimidation or deception, and (b) lawfully, adhering to all relevant rules of law, whether derived from statute or common law, relating to the collection of personal information.
Collects Information From Reliable Sources [P][C]
Management confirms that third parties from whom personal information is collected (that is, sources other than the individual) are reliable sources that collect information fairly and lawfully.
Informs Data Subjects When Additional Information Is Acquired [P][C]
Data subjects are informed if the entity develops or acquires additional information about them for its use.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Privacy | Authorized Use | Documented evidence of authorized use definitions for privacy-related data operations. |