Specify the purpose of data collection
Summary
The system must specify the purpose of personal data collection (OECD.9, ISACA.G31.3.), and it must do so before requesting the users consent for the collection.
Description
Applications usually request or collect personal data from their users. Such collection must be properly justified according to the legal requirements of each nation. These reasons must be accessible for the user in a clear manner, using easily understandable language and before requesting their consent for the collection and processing of data.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- ePrivacy Directive-6_4. Traffic data
- ePrivacy Directive-9_1. Location data other than traffic data
- GDPR-13_1-3. Information to be provided where personal data are collected from the data subject
- GDPR-14_1-4. Information to be provided where personal data have not been obtained from the data subject
- GDPR-30. Records of processing activities
- GDPR-R39. Principles of data processing
- GDPR-R40. Lawfulness of data processing
- GDPR-R45. Fulfillment of legal obligations
- SOC2®-P4_1. Additional criteria for privacy (related to use, retention, and disposal)
- SOC2®-P6_1. Additional criteria for privacy (related to disclosure and notification)
- CCPA-1798_100. General duties of businesses that collect personal information
- CPRA-1798-100. Right to know what personal information is being collected
- GLBA-502_A. Obligations with respect to disclosures of personal information – Notice requirements
- NY SHIELD Act-5575_B_6. Personal and private information
- PDPA-4_13. Consent required
- PDPA-4_14. Provision of consent
- PDPA-4_20. Notification of purpose
- POPIA-3A_13. Purpose specification - Collection for specific purpose
- PDPO-6_31. Matching procedure request
- PDPO-S1_1. Purpose and manner of collection of personal data
- HITRUST CSF-13_a. Privacy notice
- HITRUST CSF-13_d. Consent required
- LGPD-26. Rules
- OWASP Top 10 Privacy Risks-P4. Consent on everything
- OWASP Top 10 Privacy Risks-P10. Collection of data not required for the user-consented purpose
- OWASP ASVS-8_3_3. Sensitive private data
- SIG Lite-SL_154. Do agreements with third parties who have access or potential access to scoped data, address confidentiality, audit, security, and privacy, including but not limited to incident response, monitoring, data sharing and secure disposal of scoped data?
- SIG Core-P_1_5_3. Privacy
- CASA-8_3_3. Sensitive Private Data
- OWASP MASVS-PRIVACY-3. The app is transparent about data collection and usage
Vulnerabilities
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.