Having been built in before the first item of information is collected, privacy protection extends securely through the whole lifecycle of the data: strong security from start to finish, secure retention, and secure, timely destruction at the end, giving cradle-to-grave lifecycle management. Protection must be continuous across the entire domain with no gaps in protection or accountability, because privacy cannot exist where security is weak. Organisations are answerable for keeping personal information secure at every stage from collection to disposal, generally in proportion to its sensitivity and consistent with standards from recognised standards bodies, and the security standards applied must assure confidentiality, integrity and availability throughout, covering secure disposal, suitable encryption, and robust logging and control of access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.