A01 chaf6542 06 se fm indd

3 

Adequate, relevant and not excessive.

In full: ‘Personal data shall be adequate, relevant and not excessive in relation to the pur‑

pose or purposes for which they are processed.’

This specifies that the minimum necessary amount of data is requested for processing. 

There is difficulty in reconciling this provision between the needs of the individual and 

the needs of the company. The more details that an organisation has about a customer, 

Figure 4.8

Information flows that need to be understood for compliance with data 

protection legislation

Do I understand?

•  the purpose

•  likely consequences

•  future use

…of my given data

‘Data subject’

i.e. prospect 

or customer

‘Data controller’

Individual in organisation

responsible for 

personal data

1 Obtain ‘personal data’

2 Store ‘personal data’

3 Disseminate and use

  ‘personal data’

4 Modify and

  delete data

M04_CHAF6542_06_SE_C04.indd   143

7/23/14   12:18 PM

---

144

Part 1  Introduction

the better they can understand that customer and so develop products and marketing 

communications specific to that customer.