Which principle requires obtaining informed consent before collecting or using personal data?

• A. Privacy policy
• B. Informed consent
• C. Data retention
• D. Access control

Answer: (B)

Obtaining informed consent before collecting or using personal data centers on respecting an individual's autonomy and meeting privacy-law requirements. Informed consent means you’re clearly told what data will be collected, how it will be used, who it may be shared with, and for how long it will be stored, and you freely agree before any processing happens. This is the principle that directly addresses getting permission from the person whose data is involved.

A privacy policy, while important, describes how data is handled and sets expectations; it does not by itself require you to give permission. Data retention concerns how long data is kept, not whether you’ve consented to collect or use it. Access control is about restricting who can view or modify data, not about obtaining consent.