A marketing agency receives a customer list ‘to help with a campaign’ but is given no instructions on permitted purposes, retention, or deletion. Which third-party sharing requirement is most clearly missing?
Select an answer to reveal the explanation.
Short Explanation
Handing over a customer list without rules is like lending your keys with no address on the tag. Purpose, lawful basis, and protective instructions—including how long to keep and when to delete—have to travel with the data. A vague ‘help with a campaign’ is not a complete brief.
Full Explanation
Sharing personal data with a third party requires a lawful basis, purpose limitation, and appropriate contractual or organisational safeguards reflecting the recipient’s role. Instructions on permitted use, retention, and deletion are core protective arrangements for processors and remain essential discipline for other sharing models. Absence of those instructions creates uncontrolled secondary use and retention risk.