Category 13 - Privacy Practices

Category 13 addresses privacy practices, requiring organizations to establish and maintain policies and procedures that protect personally identifiable information throughout its lifecycle. It covers consent management, data-subject rights, minimisation, purpose limitation, retention schedules, and mechanisms for responding to privacy incidents, ensuring compliance with applicable privacy regulations and standards.