Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 5
Principles relating to processing of personal data
Chapter 2|Principles|📖 5 min read
1. Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes ('purpose limitation');
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy');
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation');
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality').
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability').
Understanding This Article
Article 5 is the cornerstone of GDPR, establishing the fundamental principles that underpin all data processing activities. These principles are not optional - they apply to all processing covered by GDPR and must be considered at every stage of data handling.
Lawfulness, Fairness and Transparency (a): Lawfulness requires one of the legal bases in Article 6 (consent, contract, legal obligation, vital interests, public task, or legitimate interests). Fairness means processing data in ways people would reasonably expect and not in deceptive or harmful ways. Transparency requires clear, plain language communication about how data is used - achieved through privacy notices, policies, and direct communications with data subjects.
Purpose Limitation (b): Before collecting data, you must identify specific, explicit, and legitimate purposes. You can't collect data 'just in case' you need it later. Once collected for one purpose, you generally can't repurpose it for something incompatible without a new legal basis. However, further processing for archiving, scientific/historical research, or statistics is given flexibility if appropriate safeguards exist.
Data Minimisation (c): Only collect what you actually need. If you can achieve your purpose with less data, you should. This principle pushes against the 'collect everything' mentality common in the big data era. For example, if you need to verify someone is over 18, ask for their date of birth, not their full ID document.
Accuracy (d): Data must be accurate and kept up to date. You must have processes to correct or delete inaccurate data without delay. This ties to data subjects' rights to rectification under Article 16. Regularly review data quality, especially for consequential decisions.
Storage Limitation (e): Don't keep personal data longer than necessary for the purposes you collected it. You should define retention periods based on legal requirements, business needs, and data subject expectations. After that period, data should be deleted or anonymized. Exceptions exist for archiving, research, and statistics with proper safeguards.
Integrity and Confidentiality (f): Implement appropriate security measures to protect data from unauthorized access, accidental loss, destruction, or damage. 'Appropriate' depends on the risks involved - sensitive data requires stronger protections. This connects to Article 32's security requirements.
Accountability (2): This is GDPR's meta-principle. It's not enough to comply; you must be able to prove your compliance. This requires documentation, policies, records of processing activities, data protection impact assessments, and regular reviews. Accountability shifts the burden of proof to controllers.
Key Points
Establishes six fundamental principles that must govern all personal data processing: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity/confidentiality
Lawfulness requires a legal basis under Article 6; fairness means no deceptive or misleading practices; transparency requires clear communication with data subjects
Purpose limitation: data must be collected for specific, explicit, legitimate purposes and not used incompatibly with those purposes
Data minimisation: only collect and process data that is adequate, relevant, and limited to what's necessary
Accountability principle: controllers must not only comply but also be able to demonstrate compliance with documented evidence
Practical Application
Lawfulness, Fairness, Transparency Example: A fitness app must have a legal basis (e.g., consent) to collect health data (lawfulness), not use that data for undisclosed advertising purposes (fairness), and provide a clear privacy notice explaining data collection and use in plain language (transparency). Hidden data collection or misleading privacy policies violate this principle.
Purpose Limitation Example: An online retailer collects email addresses to send order confirmations (specified purpose). They cannot later use those emails for marketing without obtaining separate consent for that new purpose. However, they could use anonymized purchase data for statistical analysis under the research exception.
Data Minimisation Example: A newsletter signup should only ask for an email address, not full name, date of birth, phone number, and address. A job application might legitimately need more information, but shouldn't ask for nationality if it's not relevant to the position. Default to collecting less, not more.
Accuracy Example: A bank must update customer addresses when notified of moves, and correct errors promptly. An HR system should have processes for employees to review and update their personal information annually. Outdated or incorrect data should be rectified or deleted.
Storage Limitation Example: Customer service chat logs kept for 6 months to handle potential disputes, then deleted. Job applicant data kept for 1 year in case of discrimination claims, then deleted. CCTV footage retained for 30 days, then overwritten. Define clear retention schedules for each category of data.
Integrity and Confidentiality Example: Encrypting databases containing personal data, using access controls so only authorized staff can view customer records, implementing backup systems to prevent data loss, and using secure transmission protocols (HTTPS) for data transfers. Security measures should match the sensitivity of the data.
Accountability Example: Maintaining records of processing activities (Article 30), conducting Data Protection Impact Assessments for high-risk processing, documenting decisions about legal bases, keeping consent records with timestamps, training staff on data protection, appointing a DPO where required, and regularly reviewing and updating data protection measures. If a supervisory authority asks 'How do you comply with GDPR?' you should have comprehensive documentation ready to demonstrate compliance.
Practical Scenario: A marketing company must: identify a lawful basis before processing (consent or legitimate interests), clearly explain data use to individuals (transparency), collect only necessary data fields (minimisation), keep data accurate (update mechanisms), delete data when the marketing campaign ends (storage limitation), secure the database (encryption, access controls), and document all these measures (accountability).