pri-041-authoritytocollect,use,maintain&sharepersonaldata.md

SCF - PRI-04.1 - Authority To Collect, Use, Maintain & Share Personal Data

Mechanisms exist to determine and document the legal authority that permits the collection, use, maintenance and sharing of Personal Data (PD), either generally or in support of a specific program or system need.

Mapped framework controls

GDPR

• Art 5.1

SOC 2

• P3.1

Control questions

Does the organization determine and document the legal authority that permits the collection, use, maintenance and sharing of Personal Data (PD), either generally or in support of a specific program or system need?