What it means
A purpose should be concrete enough to guide design, access, retention, sharing, and user communication. New uses should be assessed for compatibility, risk, and required approval.
Why it matters
Clear purposes constrain overcollection and function creep while helping teams explain why data is needed and who may use it.
Practical focus
- Document the purpose in product and governance records
- Connect access and retention to that purpose
- Review secondary uses before activation
- Communicate material changes to affected people
Common mistakes
- Using broad purposes such as improvement or security
- Assuming collected data may be reused freely
- Allowing analytics copies to escape governance
- Keeping data after the purpose has ended
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: