pri-04-restrictcollectiontoidentifiedpurpose.md

SCF - PRI-04 - Restrict Collection To Identified Purpose

Mechanisms exist to collect Personal Data (PD) only for the purposes identified in the data privacy notice and includes protections against collecting PD from minors without appropriate parental, or legal guardian, consent.

Mapped framework controls

GDPR

• Art 5.1

ISO 27002

• A.5.33

SOC 2

• P3.0
• P3.1

Control questions

Does the organization collect Personal Data (PD) only for the purposes identified in the data privacy notice and includes protections against collecting PD from minors without appropriate parental, or legal guardian, consent?