pri-054-usagerestrictionsofsensitivepersonaldata.md

SCF - PRI-05.4 - Usage Restrictions of Sensitive Personal Data

Mechanisms exist to restrict the use of Personal Data (PD) to only the authorized purpose(s) consistent with applicable laws, regulations and in data privacy notices.

Mapped framework controls

GDPR

• Art 10
• Art 11.1
• Art 18.1
• Art 18.2
• Art 5.1
• Art 9.1
• Art 9.2

ISO 27002

• A.5.33

SOC 2

• P4.0
• P4.1

Control questions

Does the organization restrict the use of Personal Data (PD) to only the authorized purpose(s) consistent with applicable laws, regulations and in data privacy notices?