Collection

The Organization must seek to collect the minimum amount of personal data possible. If personal data is collected from a third party, the controller must ensure that the personal data is collected in accordance with the law.