pri-021-purposespecification.md

SCF - PRI-02.1 - Purpose Specification

Mechanisms exist to identify and document the purpose(s) for which Personal Data (PD) is collected, used, maintained and shared in its data privacy notices.

Mapped framework controls

GDPR

• Art 13.1
• Art 14.1
• Art 14.2

ISO 27002

• A.5.34

Control questions

Does the organization identify and document the purpose(s) for which Personal Data (PD) is collected, used, maintained and shared in its data privacy notices?