Collecting Data Companies must explicitly explain what data they will collect and how they will use this data Storing Data Companies can only store PII if they have a valid reason to, and they must ensure the PII is secured.