Ensure authority to collect

Get authority to collect the personal information

This is a critical first step in ensuring a successful initiative.

Legal authority

You must be legally allowed to collect, create, or use the personal information involved in your initiative. In the privacy world, this is referred to as legal authority. Simply put, you can’t collect and/or use personal information without the legal authority to do so, regardless of whether your initiative needs it to meet its objectives.

Privacy tip: Getting consent to collect an individual’s personal information doesn’t replace having legal authority.

How to confirm legal authority

Legal authority for your initiative can be found in departmental or program-specific legislation.

A full list of policies, regulations and laws by department or agency may help you identify whether your initiative has legal authority to collect and use personal information.

If you still don’t know whether you have legal authority, you should reach out to your institution’s legal services unit. They will be able to advise on whether legal authority exists and if not, what is required to obtain it.

Page details

Date modified: