Controllers are responsible for compliance with a set of core principles which apply to all processing of personal data.

These include:

• consent and legitimacy: unless otherwise provided by law, data controllers are obligated to obtain consent from the data subject
• purpose: personal data can only be collected and processed for a specific and legitimate purpose
• proportionality and relevance: personal data must only be processed in a relevant and necessary manner regarding the purpose and objectives of the processing
• lawfulness and fairness: data controllers must collect and process data in a fair, lawful, and not fraudulent manner
• data retention: a specified period of time should be determined in advance depending on the purpose of processing to ensure that personal data is not stored indefinitely
• security and confidentiality: all responsible persons for processing personal data must not only ensure the security of data or files to prevent their destruction, or alteration; but also prevent unauthorized access to personal data contained in a file or intended to form part of the files
• prior formalities: the processing of personal data and any interconnection and interoperability of sensitive data files relating to minors is subject to prior authorisation from the data protection authority.