Explanation
A data use policy is a document that defines the rules and guidelines for how personal data are collected, used, stored, shared and deleted by an organization. It is an important part of data governance and compliance, as it helps to ensure that personal data are handled in a lawful, fair and transparent manner, respecting the rights and preferences of data subjects. A data use policy should include the requirements for collecting and using personal data, such as the legal basis, the purpose, the scope, the consent, the data minimization, the accuracy, the security and the accountability. These requirements help to establish the legitimacy and necessity of data processing activities, and to prevent unauthorized or excessive use of personal data.
References:
* ISACA Privacy Notice & Usage Disclosures, section 2.1: "We collect Personal Information from you when you provide it to us directly or through a third party who has assured us that they have obtained your consent."
* Chapter Privacy Policy - Singapore Chapter - ISACA, section 2: "We will collect your personal data in accordance with the PDPA either directly from you or your authorized representatives, and/or through our third party service providers."
* Data Minimization-A Practical Approach - ISACA, section 2: "Enterprises may only collect as much data as are necessary for the purposes defined at the time of collection, which may also be set out in a privacy notice (sometimes referred to as a privacy statement, a fair processing statement or a privacy policy)."
* Establishing Enterprise Roles for Data Protection - ISACA, section 3: "Data governance is typically implemented in organizations through policies, guidelines, tools and access controls."

Explanation
Obtaining executive support is the first step in developing an organization-wide strategy to address data privacy risk, as it ensures that the privacy program has the necessary resources, authority, and alignment with the organization's goals and objectives. Without executive support, the privacy program may face challenges in implementing and enforcing privacy policies, procedures, and controls across the organization. References: 2 Domain 1, Task 1