Requirement
The entity limits the use of personal information to the purposes identified in the entity’s objectives related to privacy.
Points of Focus
Uses Personal Information for Intended Purposes [P][C]
Requirement: Personal information is used only for the intended purposes for which it was collected and only when implicit or explicit consent has been obtained, unless a law or regulation specifically requires otherwise.
Explanation
Personal information may only be used for the purposes stated when it was collected and for which consent was given, unless a law specifically requires otherwise. Auditors test whether the organization has controls preventing personal data from being repurposed — for marketing, analytics, or anything else — without fresh notice and consent.
