The data permit authority always supplies data in a manner that maximises the protection of personal data in each situation.  Additionally, only the minimum amount of data that is necessary for the instance in question is supplied.
After a data permit has been granted, the data permit authority collects data saved by the various controllers, combines these and supplied them to the applicant for use in a secure user environment.
The Act also lays down provisions on the secure user environment where permit recipients can process data.  As a rule, the data is supplied to a permit recipient for processing via a remote connection, so that the data remains in the data permit authority’s secure user environment.
In some situations it is necessary to hand over the data to the permit recipient. In these instances, the recipient must prove that they will handle the data as laid down in the Act in a controlled manner, in an environment that meets with data security requirements.
Additionally, the Act requires that information systems store the processing and event history of data, meaning the systems create a log on various events. This will specify, for example, who has processed the data, how and when.