O3.26 Implement strict controls to enforce purpose limitation and restrict secondary data use

Principle

O3: Ensure data privacy by design

Risk

RS1 Privacy vulnerability, SV1 Digital distrust

Lifecycle Stage

L2: Strategy and Design

Practices

Design DPI systems to enforce data processing strictly according to the predefined purposes.

Design tools that require explicit user consent for any data use beyond the initially stated purpose.

Resources

Case Studies

References