Article 5 GDPR - Principles relating to processing of personal data

1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Relevant Recitals

Frequently Asked Questions

Short answers to common questions about this provision. They are general information and not legal advice.

Paragraph 1 requires that personal data be processed lawfully, fairly and transparently, collected for specified, explicit and legitimate purposes, adequate, relevant and limited to what is necessary, accurate and kept up to date where necessary, kept in identifiable form no longer than necessary, and processed with appropriate security. Paragraph 2 adds that the controller is responsible for, and must be able to demonstrate, compliance with all of these.

No. Point (b) of paragraph 1 prohibits only further processing that is incompatible with the purposes for which the data were collected, and it deems further processing for archiving in the public interest, scientific or historical research or statistical purposes compatible when carried out in accordance with Article 89(1). For other new purposes, compatibility is assessed under the factors in Article 6(4).

Point (e) of paragraph 1 permits keeping data in a form which allows identification of data subjects only for as long as necessary for the purposes of the processing. Longer storage is allowed solely for archiving in the public interest, scientific or historical research or statistical purposes under Article 89(1), subject to appropriate technical and organisational safeguards, and anonymisation removes the data from the principle altogether since identification is no longer possible.

The controller must not only comply with the principles of paragraph 1 but also be able to demonstrate that compliance. This evidentiary dimension is operationalised elsewhere in the Regulation, notably through the records of processing activities under Article 30, the data protection by design duty in Article 25 and, where required, data protection impact assessments under Article 35.

Article 6 gives concrete content to the lawfulness element of point (a) of Article 5(1), since processing without a valid legal basis is unlawful. The remaining principles apply cumulatively on top of any legal basis, so processing resting on a sound Article 6 ground still infringes the Regulation if it breaches, for instance, data minimisation or storage limitation, and infringements of the basic principles attract the higher fining tier under Article 83(5)(a).