Principal 3

3. Personal data shall be adequate, relevant and not excessive.

You should only keep personal information for the duration of time needed to complete the original, intended purpose. After this time the personal data should be destroyed.

Information may not be obtained and held onto on the basis that it may be useful in the future for an as yet unidentified purpose.

You should also only hold as much personal data as you need for the purpose – no more. This information has to be relevant and sufficient enough to be able to complete the intended purpose.

For example, a sports group wanting to send out a monthly newsletter will require solely the names and contact details of its members. The group does not need to obtain information on age, ethnic background or family as it is irrelevant to the purpose.