Part of compliance with data protection law is compliance with the key data protection principles, which represent the foundational purposes of data protection. Organisations need to comply with the data protection principles whenever they process personal data. These principles include:
the accountability principle - you are responsible for and must be able to demonstrate compliance with the law on data protection
lawfulness, fairness and transparency - any personal data collected must be processed fairly, lawfully and in a transparent manner
purpose limitation - personal data should only be collected for specified, explicit and legitimate purposes
data minimisation - personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is processed
accuracy - any personal data processed must be accurate and kept up to date
storage limitation - personal data must not be kept for longer than necessary
integrity and confidentiality (security) - personal data must be processed in a way that ensures the appropriate security of the data
Your APD should cover these principles and set out your procedures for adhering to them. For more information on the principles and how to comply with them, read Data protection principles.