Principles to remember

1. Collect only what is necessary

Collect only the information necessary for a specific purpose (s. 4). Reflex question: "If I did not collect this field, could I still provide the service?"

2. Valid consent

Consent must be manifest, free, informed and given for specific purposes (s. 14):

• requested in simple and clear terms, separately from any other information (not buried in terms of use);
• valid only for the time needed for the stated purposes;
• express if the information is sensitive;
• for a minor under 14, given by the person with parental authority (s. 4.1).

Example (SaaS). A pre-checked "I accept analytics tracking" box is not valid consent: an explicit opt-in is required.

3. Transparency

At collection, inform the person of the purposes, means, rights and the possibility to withdraw consent (s. 8). Governance policies are published in plain language (s. 3.2). Profiling, identification or location technologies must be off by default (s. 8.1).

4. Protection by default

Privacy settings of a product or service offered to the public must provide the highest level of confidentiality by default (s. 9.1).

5. Individual rights

Access, rectification (s. 27 and 28), withdrawal of consent, information about decisions made by fully automated processing (s. 12.1) and portability (since 2024-09-22).