To ensure that the organisation is aware of any risks associated with the processing of particular types of personal information; 

To enable the organisation to meet its own requirements for the management of personal information;

To impose controls in line with the organisation’s acceptable level of risk; and

To ensure that the organisation meets applicable statutory, regulatory and contractual requirements