P4.1 - Personal Information Used for Identified Purposes

P4.1 requires that an organization collect, retain, and disclose personal information only for purposes that have been identified, documented and communicated to the individuals concerned. The entity must ensure that the use of such data aligns with the stated purpose and that any further processing is consistent with the original intent unless additional consent is obtained.