01 — Have a lawful purpose
Personal data may only be processed in line with the Act — typically with consent, or for certain legitimate uses the Act permits.
02 — Provide appropriate notice
Before requesting consent, tell people what personal data you're collecting and why — plus how they can exercise their rights or raise a complaint.
03 — Obtain valid consent
Where consent is your basis for processing, it must be free, specific, informed, unconditional, unambiguous, and given through a clear affirmative action — limited to what's actually necessary for the stated purpose.
04 — Make withdrawal possible
People can withdraw consent, and it should be about as easy to withdraw as it was to give.
05 — Protect personal data
Put in place appropriate technical and organisational safeguards to prevent breaches.
06 — Handle personal data breaches
Know what to do — including notifying the Data Protection Board and affected individuals — if a breach occurs. See Data Breaches.
07 — Don't keep data forever
Erase personal data once consent is withdrawn or the purpose it was collected for no longer applies, unless another law requires you to retain it.
08 — Provide grievance redressal
Give people an effective way to raise concerns about their personal data.
09 — Manage your processors
If someone else processes personal data on your behalf, that relationship needs to sit under a valid contract — the responsibility stays with you.
10 — Be ready to demonstrate compliance
If a question arises about consent, you need to be able to show that proper notice was given and valid consent was obtained.