GDPR Data Collection Principles

What are the key principles for the processing of personal data?

The GDPR sets out seven key principles:

1.Lawfulness, fairness and transparency - The organisation must ensure that it does not do anything that is contradictory with any of the laws. They must use personal data in a way that is fair and must be clear, open and honest with people from the start about how their personal data will be used.

2. Purpose limitation - The organisation must be clear about what the purposes for processing are from the start. Purpose limitation also implies that an organisation can only use the personal data for a new purpose if either this is:

• Compatible with your original purpose
• Has obtained consent of the individual
• There is a clear obligation that is set out in law

3. Data minimisation - This principle requires collecting a minimal amount of data that is absolutely necessary for the purpose of processing.

4. Accuracy - This principle requires that organisations take all reasonable steps to ensure the personal data they hold is not incorrect or misleading as to any matter of fact. When a company determines that personal data is inaccurate or deceptive, it must take appropriate action to correct or delete it as soon as possible.

5. Storage limitation - This requires that organisations must not keep personal data for longer than it is necessary. For example, when a client has stopped using all the products from your company, it is not necessary that you keep storing their data 20 years after they have left.

6. Integrity and confidentiality (security) - The ‘integrity and confidentiality’ principle of the GDPR is also known as the security principle as it is all about measures an organisation takes. This principle concerns the privacy of personal data in order to ensure that the organisations have adequate security measures in place to protect the personal data they possess.

7. Accountability - The accountability principle requires organisations take responsibility for what they do with personal data and how they comply with the other principles.