Personal data must be processed lawfully, fairly, and transparently in relation to individuals, data should be collected for specified, explicit, and legitimate purposes, collect only the data that is necessary for the intended purpose, collect only the data that is necessary for the intended purpose, Data should be retained for no longer than necessary for the intended purpose, ensure appropriate security measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage, organizations are responsible for demonstrating compliance with these principles