Legally binding PII disclosures

The organization should reject all non-legally binding personal data disclosure requests, but accept all contractually defined personal data disclosures that the customer has accepted. The relevant customer must be asked before handing over personal data.