The test behind most decisions.
WHAT NECESSARY MEANS
The processing is required to achieve the purpose, not merely convenient.
WHAT THE TEST IS
Could the purpose be achieved another way, with less data or less intrusion?
WHAT PROPORTIONATE MEANS
The intrusion is justified by the benefit.
WHY BOTH MATTER
Something can be necessary for a purpose that does not justify it.
WHAT TO ASSESS
The purpose, stated specifically Whether this processing achieves it Whether alternatives exist The impact on individuals Whether safeguards reduce that impact
WHY SPECIFICITY OF PURPOSE MATTERS
Vague purposes justify anything.
WHAT A VAGUE PURPOSE SOUNDS LIKE
Improving the business.
WHAT A SPECIFIC ONE SOUNDS LIKE
Identifying which support articles fail to answer the question asked.
WHAT ALTERNATIVES TO CONSIDER
Less data Aggregated data Shorter retention Narrower access
WHAT TO DOCUMENT
The alternatives considered and why they were rejected.
WHY
It is what demonstrates the assessment was genuine.
WHAT TO AVOID
Concluding necessity because the system was already built that way.
WHAT TO REVISIT
The assessment, when the purpose or the processing changes.
WHAT TO ACCEPT
That some processing fails the test and should not proceed.
