8.2 Conditions for collection and processing

Section 8.2 of ISO/IEC 27701:2019 outlines the criteria an organization must satisfy before collecting or processing personal data, requiring a lawful basis, clear purpose, data minimisation and transparency to data subjects. It also mandates that processing be necessary, proportionate and documented in privacy policies.