Collection and processing of personal data must be carried out lawfully, fairly, and for specific, explicit, and legitimate purposes. Data must be adequate, relevant, and not excessive in relation to the purposes for which it is collected.

As a general rule, the data subject’s prior, informed, and express consent is required for the processing of personal data, unless an exception provided by law applies (such as data derived from public sources or processing necessary for legal or contractual obligations).

Additionally, data controllers must ensure the accuracy, security, and confidentiality of the personal data processed.