This chapter establishes the core principles that govern all personal data processing activities under the GDPR. These principles form the backbone of data protection compliance and must be adhered to in all processing operations. The chapter also introduces the fundamental principle of accountability and sets out the legal bases for lawful processing.
Overview
Chapter II: Principles
Chapter II establishes the fundamental principles that must guide all personal data processing activities. These principles are not merely aspirational but legally binding requirements that controllers must demonstrate compliance with.
The Seven Key Principles (Article 5):
- Lawfulness, Fairness, and Transparency: Processing must have a legal basis, be conducted fairly, and information must be provided to data subjects in a clear and accessible manner.
- Purpose Limitation: Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Data Minimization: Only data that is adequate, relevant, and limited to what is necessary for the purposes should be processed.
- Accuracy: Personal data must be accurate and kept up to date, with every reasonable step taken to erase or rectify inaccurate data.
- Storage Limitation: Data should be kept in a form that permits identification of data subjects for no longer than necessary for the processing purposes.
- Integrity and Confidentiality: Data must be processed securely using appropriate technical and organizational measures to protect against unauthorized or unlawful processing and accidental loss, destruction, or damage.
- Accountability: The controller is responsible for and must be able to demonstrate compliance with all the principles.
Legal Bases for Processing (Article 6):
- Consent of the data subject
- Contractual necessity
- Legal obligation
- Vital interests protection
- Public interest or official authority
- Legitimate interests (except for public authorities)
Special Categories of Data (Article 9):
The GDPR provides enhanced protection for sensitive personal data, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sex life or sexual orientation. Processing such data is generally prohibited unless specific conditions are met.
Criminal Convictions Data (Article 10):
Processing of personal data relating to criminal convictions and offenses is restricted and must be carried out only under official authority control or when authorized by Union or Member State law.