According to the DSCI Privacy Framework and aligned with global privacy principles such as those found in the OECD and APEC frameworks, "Collection Limitation" emphasizes that personal data should be collected in a manner that is lawful and fair, and should be limited to what is necessary for the identified purposes.
As per DSCI Assessment Framework for Privacy (DAF-P), this principle ensures organizations collect only relevant data by minimizing unnecessary data acquisition, thereby reducing the privacy risks. The principle mandates:
"Personal data collected should be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed." This is designed to promote responsible data stewardship and ensure minimal exposure of individuals' personal information.

As per DAF#P guidelines, the certification issued by DSCI remains valid for a period of three years, during which surveillance assessments are conducted to verify continued compliance. These surveillance checks help ensure the privacy program maintains its effectiveness over time.

A privacy incident management plan generally includes detection, containment, remediation, and communication of incidents. It also includes root cause analysis and steps to prevent recurrence. However, deferring data access rules for business users is unrelated to incident management. Instead, it falls under access governance or information usage policies.
Hence, option B is outside the scope of incident management as per the DSCI Privacy Framework.

The DSCI Privacy Framework recommends that a privacy program must be tailored based on several practical and operational inputs. These include:
* Reported privacy incidents (to identify risk patterns and weaknesses)
* Contractual obligations (which dictate processing standards for third parties)
* Exposure to personal information (understanding where and how personal data is processed)
* Regulatory compliance (to ensure adherence to national and international laws) All four listed aspects contribute to the risk-based and dynamic implementation of privacy strategies within an organization.