7.2 Conditions for collection and processing

Entry 7.2 in ISO/IEC 27701:2019 specifies the conditions that must be met before personal data can be collected or processed, requiring that activities be lawful, fair and transparent, limited to defined purposes, and based on appropriate consent or other legal grounds, while also ensuring data minimisation and the protection of data subjects' rights.