CRISC: Certified in Risk and Information Systems Control

Personal information is subject to purpose limitation: reuse for a different purpose must be compatible with the original purpose and supported by an appropriate lawful basis. Specific, informed consent is the relevant listed control when the intended secondary use was not covered by the original consent; data-breach safeguards, cross-border controls, and business-impact analysis do not establish authorization for that new use.