Customs data protection framework limits personal data use to origin verification, with breach, access and redress safeguards. Personal data transferred between the customs authorities of the Parties is subject to a dedicated framework covering definitions, scope, purpose limitation, accuracy, minimisation, storage limitation, security, breach notification, access, rectification, onward disclosure, redress, review, suspension and notification. The data may be used only to establish the authenticity of an origin declaration and may not be further processed incompatibly with that purpose without written approval. The Annexure also requires transparency notices, response time limits, safeguards for onward transfers, and mechanisms for administrative and judicial redress.