Purpose limitation

Purpose limitation is one of the core processing principles of the GDPR and is enshrined in Art. 5(1)(b) GDPR. According to it, personal data may only be collected for specified, explicit and legitimate purposes. The controller must determine and document the purpose concretely before collection; blanket or vague statements such as "business operations" are not sufficient. The defined purpose simultaneously serves as the benchmark for further principles such as data minimisation and storage limitation, because the necessity of the data and the retention period are always measured against the specified purpose.

Subsequent processing for a purpose other than the original one (purpose change) is only permitted under narrow conditions. It is readily possible where the data subject has given consent or where a Union or Member State law authorises the further processing. In the absence of such a basis, the controller must carry out a compatibility assessment under Art. 6(4) GDPR: this examines, among other things, the link between the old and the new purpose, the context of collection, the nature of the data, the possible consequences for the data subjects and the existence of appropriate safeguards such as encryption or pseudonymisation.

Under the second half-sentence of Art. 5(1)(b) GDPR, further processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes is privileged; subject to appropriate safeguards under Art. 89(1) GDPR, it is not considered incompatible. Every purpose change must also observe the information duties under Art. 13(3) and Art. 14(4) GDPR. Anyone who disregards purpose limitation risks fines under Art. 83(5) GDPR and claims for damages from data subjects; clean documentation of purposes in the record of processing activities is therefore also an expression of accountability.