NIST Privacy Framework, Govern-PGV.PO-P1

Collect personal data only for determined, explicit and legitimate purposes, keep it accurate and updated, and do not retain it beyond the period the purpose requires.

Process personal data lawfully, transparently and in good faith, collect it only for determined, explicit and legitimate purposes, keep it adequate, relevant and limited to the minimum necessary, keep it accurate and up to date, and do not keep it identifiable for longer than the purposes require.

Limit your collection, use, retention, and sharing of a California consumer's personal information to what is reasonably necessary and proportionate to the purpose you disclosed.

Comply with the ten Schedule 1 fair information principles, including limiting use and disclosure to the purposes for which information was collected and keeping it only as long as necessary.

Have a lawful basis for collecting and processing personal data, and hold it only for specified purposes.

Apply the Act's core principles to every processing activity: lawfulness, fairness, transparency, security, purpose limitation, accuracy, proportionality, and a retention period no longer than the purpose requires.

If you provide electronic signature certification services, collect the personal data needed for issuing and keeping the certificates directly from the person concerned, and use it only for that purpose absent the person's express consent otherwise.

Collect and process personal data only for determined, explicit, and legitimate purposes, and do not process it later in a way incompatible with those purposes.

Limit personal information processing to the minimum scope and duration necessary for a stated, specific purpose.

Apply the legality, purpose limitation, freedom, accuracy, transparency, restricted access and confidentiality principles to every processing operation, and do not process partial, incomplete, fragmented or misleading personal data.

Collect and process personal data lawfully and fairly, only for determined and legitimate purposes, keep it accurate and up to date, and do not retain it beyond the period necessary for those purposes.

Collect personal data for an electronic certification service directly from the data subject, and use it only for the purpose it was collected for, unless the data subject expressly consents otherwise.

Do not use collected data for a purpose incompatible with the one disclosed at collection.

Collect and process personal data lawfully and fairly, for specified and legitimate purposes, keeping it no longer than those purposes require, accurate, and transparent to the person concerned.

Do not process personal data for historical, statistical or scientific purposes beyond its original collection unless one of the statutory safeguards applies, or process only anonymous data for that further purpose.

Collect Personal Data only for legitimate, specific purposes that are transparent to the Data Subject, keep it correct, valid and secured, and do not retain it longer than that purpose needs.

Collect only personal data that is sufficient, relevant and not excessive for your specific, legitimate purpose, and keep it accurate, complete and up to date.

If you are a private entity, process a data subject's data only for the services you actually provide them, and do not transfer or use a third party's data for a different purpose without that party's authorization.

Collect personal information only for a specified, explicit and legitimate purpose, and do not further process it in a way incompatible with that purpose.

Collect personal data for specified, explicit and legitimate purposes and do not further process it in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is not considered incompatible, in accordance with Article 89(1) (Article 5(1), point (b)).

Limit personal data to what is adequate, relevant and necessary in relation to the purposes for which it is processed, data minimization (Article 5(1), point (c)).

Collect and process personal data fairly and lawfully, only for determined, explicit and legitimate purposes, and keep it accurate, adequate and no longer than those purposes need.

Collect personal data only for explicit and legitimate purposes, keep it adequate and relevant to those purposes, keep it accurate and up to date, and process it securely.

Carry out a compatibility assessment before putting personal data to a new purpose, weighing the relationship between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place.

Process personal data only for a lawful purpose directly related to your activity, and hold no more than is adequate and not excessive for that purpose.

A data controller must comply, for all the personal data it processes, with the data protection principles in section 4(1) of the Data Protection Act 2023: process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes; keep it adequate, accurate and identifiable for no longer than necessary; and process it with appropriate security.

Limit the collection of personal data from an Indiana consumer to what is adequate, relevant, and reasonably necessary for the purposes disclosed to that consumer, and do not process it for an incompatible purpose without consent.

Obtain personal data only for one or more specified and lawful purposes, and do not further process it in a manner incompatible with those purposes.

Hold no more personal data than is adequate, relevant and limited to what is necessary for the purpose, keep it accurate and up to date, and do not keep it for longer than that purpose requires.

An app that collects, uses, or discloses the personal data of an individual in Japan must give notice of, or publicly disclose, its purpose of use before or promptly after collection, must not acquire the data by wrongful or deceptive means, and must confine use to the stated purpose unless a statutory exception or the data subject's consent applies.

Limit collection to the purposes disclosed to the consumer, and use a written contract to bind any processor to your instructions.

Process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose, and collect no more than is necessary for that purpose.

Further process personal data only for a purpose compatible with the original purpose, and do not retain personal data longer than necessary to achieve that purpose unless retention is required or authorised by law, necessary for a legitimate business purpose, or the data subject has consented to it.

Establish a lawful basis under Article 5 before processing personal data of a person in Kosovo, and apply the Article 4 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability throughout.

An app that collects, uses, or discloses the personal data of individuals in Kyrgyzstan must process it lawfully, fairly, and transparently, limit use to the stated purpose, minimize what is collected, keep it accurate, and limit retention to the processing purpose. An organization with more than ten employees must designate a personal-data-responsible person and provide staff training.

Collect personal data faithfully and for legitimate, specific and explicit purposes, keep it appropriate to and within those purposes, correct, complete and as relevant as possible, and do not later process it for purposes out of line with the objectives you stated, except for statistical, historical or scientific research.

Collect personal information only for a specified, explicit and legitimate purpose, and do not further process it in a way incompatible with that purpose.

Collect personal data only for specified and legitimate purposes declared before or soon after collection, process it fairly and lawfully, keep it accurate, adequate and not excessive, and retain it only as long as necessary.

Identify the purposes for which customer information is collected, at or before collection, and do not use it for an undisclosed purpose.

Collect and process personal data fairly, lawfully, and only for determined, explicit, and legitimate purposes, and do not use it later for another purpose without the data subject's consent or a purpose the law itself provides.

Keep personal data adequate, relevant, accurate, and no longer than those purposes require, unless it is kept for archival, historical, statistical, or scientific purposes under the safeguards the law or the CMIL sets.

Process personal data fairly and lawfully, collect it only for specified, explicit and legitimate purposes, and do not process it further in a way incompatible with those purposes.

Keep personal data adequate, relevant and not excessive for its purpose, accurate and up to date, and take every reasonable step to erase or rectify data that is inaccurate or incomplete; do not keep it in identifiable form for longer than the purpose requires.

A Controller or Processor needs a lawful basis before processing personal data, must collect it only for specific, explicit and legitimate purposes declared before collection, and must not process it further in a way incompatible with those purposes.

Personal data must be adequate, relevant and necessary to the declared purposes, accurate and kept up to date, and retained in identifiable form no longer than those purposes need.

Collect and process personal data fairly, lawfully, and without fraud, only for determined, explicit, and legitimate purposes, never using it for another purpose, and keep it adequate, proportionate, and relevant to those purposes, accurate and updated where necessary, and identifiable for no longer than those purposes require.

Process personal data lawfully, fairly, and transparently, for a specified and legitimate purpose, and do not further process it in a way incompatible with that purpose.

Collect personal data only by lawful and fair means, and limit it to what is relevant and necessary to fulfill the purpose for which it is processed.

Limit processing of personal data to the purposes stated in the privacy notice, and obtain the data subject's consent again before processing it for a different purpose.

Limit your collection of a Minnesota resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose you disclosed to them, and obtain consent before processing it for an undisclosed, incompatible secondary purpose.

Process personal data only where it is collected fairly and lawfully for determined, explicit and legitimate purposes, and do not process it later in a way incompatible with those purposes.

Keep personal data adequate, relevant, accurate, and not excessive for those purposes, and do not retain it in identifiable form longer than the purposes require.

Specify the purpose for collecting personal data and your identity as the processor before collecting it, and limit any later use to that stated purpose.

Limit personal data collection to what is adequate, relevant, and reasonably necessary, and describe your purposes in a privacy notice.

Limit your collection of a New Jersey resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose disclosed to the consumer.

Collect personal information directly from the individual concerned unless an exception applies, such as the individual's authorisation, the source being a publicly available publication, or non-compliance not prejudicing the individual's interests.

Process personal data only to the extent adequate, proportional, and necessary for the stated purpose, and adopt technical and organizational security measures against unauthorized access, use, alteration, loss, disclosure, transfer, or dissemination.

Collect personal data only for determined, explicit and legitimate purposes, and do not process it later in a way incompatible with those purposes or keep it longer than the purposes require.

Process personal data on one of the lawful bases section 25 recognises, and hold to the section 24 principles of fairness, lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, integrity and availability.

Limit video surveillance to the area sufficient for the goal it was installed for, and never install it in changing rooms, dressing rooms, toilets or similar rooms.

Have a lawful basis, such as consent, contractual necessity or a legal obligation, before processing a person's personal data, and use it only for the purpose for which it was collected.

Do not collect personal data by fraudulent, unfair, or unlawful means, and collect only data that is updated, necessary, relevant, and adequate to a determined, explicit, and lawful purpose stated at the time of collection.

Do not use personal data for a purpose other than the one that justified its collection, unless you first apply an anonymization or dissociation procedure.

Establish and implement governance policies and practices for personal information, including a framework for retention and destruction, and conduct a privacy impact assessment before acquiring, developing or overhauling a system or service that collects, uses, communicates, keeps or destroys personal information.

Collect personal data only for a lawful purpose connected with your function or activity, and only where the collection is necessary for that purpose.

Keep personal data only for the specified purpose it was collected for, do not use or disclose it in a way incompatible with that purpose, keep it adequate and relevant and not excessive, and keep it accurate and up to date.

Process personal data lawfully and in good faith, collect it only for specified, explicit and legitimate purposes tied to your activity, keep it adequate, relevant and not excessive, accurate and updated, and retain it in identifiable form no longer than the collection purpose requires.

Do not process personal data you access as a subcontractor, or on the controller's authority, beyond the controller's instructions except under a legal obligation, and keep confidential any personal data you learn of in the course of your duties, including after those duties end.

Disclose to a consumer the purpose of collecting information about them, and do not use or maintain that information for an undisclosed purpose.

Collect personal data for a specified, explicit and legitimate purpose, keep it to the minimum necessary for that purpose, keep it accurate, and retain it no longer than the purpose requires.

Obtain a lawful basis, such as the data subject's consent, before processing personal information, and limit processing to the purpose for which it was collected.

Process personal data lawfully and fairly, only for specified, explicit and legitimate purposes, and keep it adequate, relevant, accurate, and limited to what those purposes need.

Collect personal data only for legitimate and specific purposes, process it in a manner appropriate to those purposes, and do not retain it longer than the purpose requires unless the retention is for archiving in the public interest or for scientific, historical or statistical purposes.

Collect, process, or use the personal data of an individual in Taiwan only for a specific purpose and on one of the Act's stated lawful bases, and confine use to the purpose stated at collection unless a further basis under Article 16 or 20 applies.

Process personal data lawfully, fairly and transparently, and only for an explicit and legitimate purpose.

Collect and process personal data lawfully and fairly, only for determined and legitimate purposes, keep it accurate and up to date, and do not retain it beyond the period necessary for those purposes.

Process personal information only for a lawful purpose related to your function or activity, take all reasonable steps to keep it accurate, complete, not misleading and up to date for that purpose, and hold no more than is adequate, relevant and limited to it.

Limit collection of personal information to what is legally undertaken and necessary for the identified purpose, retain it only as long as necessary for that purpose, and do not disclose it for another purpose without the individual's prior consent.

Collect and process personal data only for a lawful, determined and explicit purpose, and keep it accurate, precise and up to date.

Collect personal data directly from the data subject, unless a listed exception applies, such as the data being in a public record, already made public by the data subject, or collected with their consent.

Collect personal data only for a lawful purpose that is specific, explicitly defined, and related to your functions or activities.

Before processing personal data, establish a lawful basis such as consent, a contract, a legal obligation, or a legitimate interest, and process it fairly, transparently, and only for the purpose collected.

Collect personal data directly from the data subject unless one of the exceptions in section 16(2) applies.

Process personal data necessarily, fairly, lawfully and for specified, legitimate purposes before a crawler or AI training pipeline collects or uses personal data of a person in Zimbabwe.