Skip to content

ACCA Applied Knowledge · Business and Technology · Regulation and financial crime

Which of the following is a typical data protection principle, as found in laws such as the EU GDPR, that personal data should meet?

Personal data should be collected for specified, legitimate purposes and not later used in a way that is incompatible with those purposes. This is the purpose limitation principle. Indefinite retention, unrestricted sharing and excessive detail would each contradict storage limitation, security or data minimisation principles.

  1. AIt should be kept indefinitely in case it is useful in future
  2. BIt should be collected for specified, legitimate purposes and not used in ways incompatible with themCorrect
  3. CIt should be shared freely with group companies without restriction
  4. DIt should be held in the most detailed form possible, regardless of need

Explanation

Purpose limitation requires data to be collected for specified and legitimate purposes and not further used incompatibly. Indefinite retention breaches storage limitation, unrestricted sharing breaches lawfulness and security, and excessive detail breaches data minimisation.

Did you get it right without looking?

One question tells you little. A timed set on Regulation and financial crime shows your real accuracy, how long you take and where you lose marks.

Practise Regulation and financial crimeFree diagnostic mock

More Regulation and financial crime questions