Required actions
- Strict data minimisation: collect only what is reasonably necessary; sensitive data only when strictly necessary; no sale of sensitive data - Conduct data protection assessments for each algorithm used with high-risk processing; no targeted advertising to under-18s
