The standard sets out six privacy principles that all employees must respect, wherever they are in the world: due care; purpose specification; reasonable limitation; transparency and openness towards employees and customers on where personal data is stored and used; choice and consent; and privacy by design.