When collecting information from someone online, you must:
- tell people why the information is being collected
- ensure the information collected is limited to the minimum needed to offer the requested service
- tell people how their information will be used and stored
- tell people who will have access to their information and who it may be shared with
Any new or significant change to a service should have a privacy impact assessment completed.