Trust resource / Ruxii
Data-handling principles
The principles guiding purposeful collection, access, retention, and deletion.
Purpose before collection
Information should be collected for a defined operating purpose and limited to what that purpose reasonably requires.
Access follows responsibility
Access should reflect organizational role, operational responsibility, and the sensitivity of the record rather than broad convenience.
Retention is deliberate
Records should be retained according to their purpose, obligations, and customer requirements, then deleted or anonymized when they are no longer required.