Processing

Plan and prepare for circumstances that preclude returning to the primary processing site.

The organization must give individuals a way to object to their data being processed. It must document the legal and regulatory rules on objection, for example objection to direct marketing, tell individuals when they are entitled to object, and offer a mechan...

The organization must delete personal data, or turn it into a form from which the individual cannot be identified or re-identified, once the identified purposes no longer need the original data, having mechanisms to erase data when no further processing is ant...

Where the purposes do not require, or no longer require, identifying the data subject, the controller need not keep, obtain or process extra information only to comply with the Law.

Personal data must be collected for a specific and clear purpose and not processed later in a way incompatible with it; further processing is allowed only where the purpose is similar or close to the original one.

The controller puts suitable measures in place so that, above all, the principles of GDPR Art. 5 (lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability) are com...