Privacy by Design Principles

DocumentKits Issue No: 1.0 Organisation Issue No:

DocumentKits Issue Date: 26/06/2020 Organisation Issue Date:

1. Scope

All new and changing processing systems and activities are subject to these principles.

2. Responsibilities

Management System Owner (MSO) is responsible for ensuring that all new processing systems and activities
are designed in accordance with these principles.

Each Process Owner is responsible for ensuring that the design is implemented.

Data Protection Officer is responsible for reviewing these principles and confirming that they meet the
standards mandated

3. Procedure

3.1 The process design procedure is described

3.2 Process designs are documented

3.3 Process designs consider all the following principles both individually and in combination .

Limit collection

3.4 This principle also applies to indirect and incidental collection of personally identifiable information (PII)
(e.g. through logs, cookies, etc.).

3.4.1 The process is designed to require only the minimum PII necessary to fulfil the purpose of the
processing.

3.5 For each process, identify:

G42
Classification_1,Classification_2,Classification_3,Classification_4
This document contains material that is distributed under licence from IT Governance Publishing Ltd.
3.5.1 What information is adequate for the purpose of the processing?
3.5.2 What information is relevant to the purpose of the processing?
3.5.3 What information is necessary for the purpose of the processing?

3.6 Where PII for the processing is optional, or the purpose has optional extensions, the process should
default to only collect the minimum.

3.7 Collection of PII should also account for new information generated by processing activities, including
temporary files.

Limit processing

3.8 Processing activities are limited to that necessary to fulfil the purpose of the processing.

3.9 Process Owner's should note that processing activities also include:
3.9.1 Disclosure;
3.9.2 Storage; and
3.9.3 Access.

3.10 Process Owner's review their processing activities to confirm that processing is limited.

Maintain accuracy and quality

3.11 G42 ensures that PII used in processing activities is as accurate, complete and up to date as is necessary
for the purpose of the processing, and that this is maintained throughout the lifecycle of the PII.

3.12 PII principals are able to actively rectify the PII held by G42 through

3.13 When PII is collected directly from the PII principal, G42

3.14 When PII is collected from another source, G42

3.15 Process Owner identifies a review period for the processing activity to reassess and/or validate the
accuracy of the PII. This is recorded

Minimise PII

3.16 Process Owner's identify how and when PII can be limited relative to the purposes of the processing,
including when the PII is no longer necessary for the purposes for which it was collected.

G42
Classification_1,Classification_2,Classification_3,Classification_4
This document contains material that is distributed under licence from IT Governance Publishing Ltd.
3.16.1 This also applies to temporary data generated as part of the processing activity.

3.17 Process Owner's document the extent to which the processing activity requires the PII to be associated
with the PII principal.

3.18 G42 minimises the PII it holds through the following methods:

3.18.1

3.18.2

3.18.3

3.19

Document owner and approval

The Management System Owner (MSO) is the owner of this document and is responsible for ensuring that it
is reviewed in line with the requirements of the management system.

The current version of this document is available to and is published

Its approval status can be viewed in the Master List of Document Approval.

G42
Classification_1,Classification_2,Classification_3,Classification_4
This document contains material that is distributed under licence from IT Governance Publishing Ltd.