Limit collection

Processing of personal data is only lawful if one of the legal bases set out in the General Data Protection Regulation is met. The organization must be able to communicate the purpose of the processing and the legal basis to the data subject and, where appropriate, to the supervisory authority.

The documentation shall include at least:

• the legal basis for the processing and the necessary additional information
• the parties to whom the processing has been outsourced
• related data sets

The organization should limit the collection of personal data to the minimum level that is essential and necessary for the purpose of processing the personal data collected.

The realization of the principle should be ensured regularly from the point of view of all processing by comparing the documentation of the management system (e.g. the purposes of use of the data) with the personal data held by the organization in practice.