1.Privacy by design
Every new feature must state the data it needs, its legal basis, its retention period and its deletion path before it is built.
2.Access control
Personal data access follows least privilege and role-based access control, with access to enhanced-control categories restricted to named roles and logged.
3.Transfers and processors
Processors must be contracted, listed in the Third-Party Services Policy and bound by data-processing terms before receiving personal data.