数据保护与隐私法

Lawfulness, Fairness and Transparency — Personal data must be processed lawfully, fairly, and in a transparent manner. There must be a lawful basis for processing (consent, contract, legal obligation, vital interests, public task, or legitimate interests).

Purpose Limitation — Data must be collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes.

Data Minimisation — Only personal data that is adequate, relevant, and limited to what is necessary for the stated purpose should be collected.

Accuracy — Personal data must be accurate and, where necessary, kept up to date. Inaccurate data must be erased or rectified without delay.

Storage Limitation — Personal data must not be kept for longer than is necessary for the purposes for which it is processed.

Integrity and Confidentiality — Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage.

Accountability — The data controller is responsible for, and must be able to demonstrate, compliance with the data protection principles.

Data Subject Rights — Individuals have rights including access (Subject Access Request), rectification, erasure ('right to be forgotten'), restriction of processing, data portability, and objection to processing.