{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Data Protection & Privacy","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-03","description":"Identify and document the specific purposes for which personal data is processed, and restrict use and disclosure to those purposes or documented compatible ones. Apply the minimum-necessary standard so only the least data required is used, disclosed, or requested for each purpose. Obtain new authority or consent before processing for any new purpose.","details":{"control_category":"administrative","control_type":"preventive","domain":"Data Protection & Privacy","guidance":[],"members":[{"control_id":"PT-3","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"P4.1","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"HIPAA-164.502","coverage":"partial","delta":"required disclosures to HHS, personal-representative and business-associate limits not addressed","framework":"hipaa","relationship":"intersects_with"}],"statement":"Identify and document the specific purposes for which personal data is processed, and restrict use and disclosure to those purposes or documented compatible ones. Apply the minimum-necessary standard so only the least data required is used, disclosed, or requested for each purpose. Obtain new authority or consent before processing for any new purpose.","title":"Limit personal-data use to stated purposes and minimum necessary","unified_id":"UC-DATA-03"},"id":"uc:UC-DATA-03","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-03","sourceIds":["hipaa","nist-800-53","soc2"],"sourceUrl":null,"title":"UC-DATA-03 — Limit personal-data use to stated purposes and minimum necessary","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:285f3538b77e796a13c6f53dd48d9325e2c57539dd54ce8496f09a649d2237ca","properties":{"rationale":"Requiring new authority/consent before any new purpose keeps processing within lawful bounds.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6129d2158ca40f8e83e0d0ea66270ff7a9176d2f6a5b156fb4870346d80c6570","properties":{"control_id":"HIPAA-164.502","coverage":"partial","delta":"required disclosures to HHS, personal-representative and business-associate limits not addressed","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-502-8e8a8216.json","targetId":"ctrl:hipaa:HIPAA-164.502","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6614f303e1a9f5e06e1199cd6a4bf787c3dc998c819912a45ecd4616fab61f55","properties":{"control_id":"P4.1","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/ctrl-soc2-p4-1-ddaa5e1f.json","targetId":"ctrl:soc2:P4.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:697c0ecd02e577f43ab75719e661bfdb73d298b91423d090f952d00322daf8c3","properties":{"control_id":"PT-3","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pt-3-71fd7d0b.json","targetId":"ctrl:nist-800-53:PT-3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a4e55f5b21884fd049c6100e09b41b1e2376154542a09f0ebff3ddee69452b4","properties":{"rationale":"The minimum-necessary/data-minimization requirement is a core privacy-by-default principle reducing over-collection and exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-privacy-no-privacy-by-design-c9472484.json","targetId":"risk:privacy-no-privacy-by-design","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7184a5f5c8c3d38881713ad140134f3a4246dfd55d4e5f125a6331072f464812","properties":{},"sourceDetailPath":"/data/v1/records/wf-r9-636a9e6e.json","sourceId":"wf:R9","targetDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","targetId":"uc:UC-DATA-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:935e9a602ba4f4838a2f1ac695db1d0e5817c01284ccf83483362e67b49b5cf3","properties":{"rationale":"Purpose limitation plus the minimum-necessary standard directly restricts over-use/over-disclosure and blocks secondary use without new authority.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-data-excessive-collection-purpose-creep-4a691595.json","targetId":"risk:data-excessive-collection-purpose-creep","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e91251e51b94359281b7802f4e678303af65735c05c6373bedd59f6c5af215ec","properties":{"rationale":"Restricting use/disclosure to documented purposes limits monitoring and appropriation of data beyond its stated purpose.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-data-surveillance-appropriation-18ad67e7.json","targetId":"risk:data-surveillance-appropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f99247900265841771a0b1df07d441b3dee659793e50eab9ce5a1454f35face9","properties":{},"sourceDetailPath":"/data/v1/records/wf-d22-f1c724b8.json","sourceId":"wf:D22","targetDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","targetId":"uc:UC-DATA-03","type":"tests"}],"schemaVersion":1}