NQ²–RUL–009 — Privacy & Personal Data

Version: 0.1 Draft
Status: Draft
Approval authority: Pending formal approval

1. Purpose limitation

Personal information should be collected and used only for identified institutional purposes or other lawful purposes that are reasonably connected to the activity.

2. Data minimization

Forms and records should request only information reasonably necessary for the relevant project, recognition, research, archival or administrative process.

3. Public visibility

Registration of a person or project does not mean that all associated personal information must be made public.

4. Consent and legal basis

Where consent is used, it should be meaningful and separated from unrelated permissions. Other lawful bases may apply where permitted by law.

5. Retention

Personal information should not be retained longer than required by institutional, archival, contractual or legal needs.

6. Requests and corrections

Requests concerning access, correction, privacy or removal should be reviewed according to applicable law and the legitimate archival requirements of the institution.