A01 chaf6542 06 se fm indd

2 

Processed for limited purposes.

In full: ‘Personal data shall be obtained only for one or more specified and lawful pur‑

poses, and shall not be further processed in any manner incompatible with that purpose 

or those purposes.’

This implies that the organisation must make it clear why and how the data will be pro-

cessed at the point of collection. Figure 4.8 suggests some of the issues that should be con-

sidered when a data subject is informed of how the data will be used. Important issues are:

● 

Whether future communications will be sent to the individual (explicit consent is 

required for this in online channels).

● 

Whether the data will be passed on to third parties (again explicit consent is required).

● 

How long the data will be kept.