Privacy

Purpose Limitation

Personal data must be collected for specified, explicit purposes and not further processed in an incompatible way.

Purpose limitation requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

What This Means

  • State clearly why you are collecting data at the point of collection
  • Don't use data collected for one purpose for something entirely different
  • If you want to use data for a new purpose, assess compatibility or obtain new consent

Compatibility Test

Further processing may be compatible with the original purpose if it is for:

  • Archiving in the public interest
  • Scientific or historical research
  • Statistical purposes

GDPR Article 5(1)(b).

Related Terms

ConsentPrivacy

A freely given, specific, informed, and unambiguous indication of agreement to data processing.

Data MinimizationPrivacy

The principle that only the minimum amount of personal data necessary should be collected and processed.

Storage LimitationPrivacy

Personal data should be kept only for as long as necessary for its stated purpose.

Legal BasisLegal

The lawful ground under which personal data may be processed — the GDPR defines six possible bases.

Pseudonymization