13.7 Data protection

The organisation shall identify its role and responsibilities under applicable data protection law for each processing activity.

It shall document:

purpose and lawful basis;

controller, joint-controller or processor arrangements;

categories of personal data and data subjects;

necessity and proportionality;

sources and recipients;

access controls;

retention and disposal;

rights-handling arrangements;

transfer arrangements; and

required impact or risk assessments.

Personal data shall be accurate and, where necessary for the purpose, kept up to date. Access shall be limited to authorised users with a defined need.

Special-category, sensitive or high-risk personal data shall be collected only where necessary and lawful and shall receive enhanced controls.

JURISDICTIONAL NOTE (informative)
UK work is subject to the UK data-protection regime, including the UK GDPR and Data Protection Act 2018. Work in the Republic of Ireland is subject to the EU GDPR and the Irish Data Protection Act 2018. Controller and processor roles depend on actual decision-making and cannot be assigned solely by the label used in a contract.