Collection
The Collection principle requires that your organization collect personal information only for the purposes identified in the notice. Specifically, 4.2.3 requires that when personal information is collected from third parties (sources other than the individual), the sources are reliable, and must collect information fairly and lawfully. If data is collected from an offshore third party, then care needs to be taken that data is collected in accordance with your organization's legal jurisdiction, as well as the third-party's legal jurisdiction.
This process necessitates performing due diligence before establishing a relationship with a third-party data provider to ensure the data is reliable, and fairly and lawfully collected. Due diligence means that your organization will need to review the privacy policies and collection methods of third parties before accepting personal information from them. If your organization is already a partner to such relationships, then due diligence needs to be performed. Any deficiencies found should be addressed or the relationship may need to be re-evaluated.