What must a Data Fiduciary do to comply?

In outline: process personal data only for a lawful purpose with consent or a recognised legitimate use; give a clear notice before or at the time of seeking consent; collect only what is necessary for the stated purpose; ensure the data is accurate and complete where it may be used to make a decision affecting the individual or shared with another Fiduciary; put in place reasonable security safeguards; report breaches to the Board and to affected individuals; erase data when the purpose is no longer served and retention is not legally required; publish contact details for handling queries; and maintain an effective grievance redressal mechanism.