Purpose limitation

What it means

Purpose limitation is the GDPR principle that personal data are collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes. The controller must know and state in advance why it is collecting the data.

The principle protects people's trust. Someone who gives a company their data for a contract should not later discover that the company used it for an entirely different purpose, such as selling it to third parties. Employees' payroll data cannot simply be reused for marketing or profiling.

Further processing for a new purpose is possible if it is compatible with the original one. Factors include the link between the purposes, the context of collection, the nature of the data, the possible consequences and the existence of safeguards. Processing for archiving in the public interest, research or statistics is, under certain conditions, considered compatible.

How it works in practice

For each processing operation, the company records the purpose in its record of processing activities and assigns a lawful basis. If it wants to use the data for a new incompatible purpose, it needs a new lawful basis, often the data subject's consent.

A typical example: a client's contact details obtained when signing a bookkeeping contract may be used to perform the contract and meet legal obligations. Sending a newsletter offering other services requires assessing whether this is a compatible purpose or whether consent is needed.

The principle is closely linked to data minimisation. When the purpose is clearly defined, it is also clear which data are really needed. A company collecting data just in case it might be useful one day breaches both principles at once.

What to watch out for

A purpose worded too broadly, such as improving services or marketing purposes, does not meet the requirement of specificity, and a supervisory authority may consider it inadequate. The purpose should be described so that the data subject understands what will happen to their data.

When sharing data within a group or with partners, check that the recipient will not use the data for another purpose. Contracts with processors must specify that data are processed only on the controller's instructions, not for the processor's own purposes.