A multinational wants to anchor its cloud privacy program in internationally recognized principles, such as collection limitation, purpose specification, use limitation, security safeguards and accountability, that have influenced many national privacy laws. Which source best fits this need?

The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, first adopted in 1980 and revised in 2013, set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. They are a widely cited international reference that informed national legislation and later regional frameworks such as the APEC Privacy Framework, which makes them a natural foundation for a privacy program operating across jurisdictions. ISO/IEC 27037 provides guidance on identifying, collecting, acquiring and preserving digital evidence; it supports forensic work, not privacy principles. NERC CIP standards govern cybersecurity for the bulk electric system in North America and apply to registered entities in that sector, not to general personal data handling. The Sarbanes-Oxley Act addresses the accuracy of financial reporting by public companies and the internal controls behind it, not the collection and use of personal data. Exam caveat: the OECD guidelines are principles, not a binding law, so the program must still map them to each applicable statute such as the GDPR or PIPEDA. Operational check: confirm the privacy policy maps each principle to concrete controls, owners and evidence in every cloud service that processes personal data.