P4.1

P4.1

The entity limits the use of personal information to the purposes identified in the entity’s objectives related to privacy.

Category

Privacy

Subcategory

Privacy Criteria Related to Use, Retention, and Disposal

Points of Focus

Uses Personal Information for Intended Purposes [P][C]

Personal information is used only for the intended purposes for which it was collected and only when implicit or explicit consent has been obtained unless a law or regulation specifically requires otherwise.

Evidence Requests

Area of Focus	Artifact	Description
Privacy	Authorized Use	Documented evidence of authorized use definitions for privacy-related data operations.