What are the 7 principles of the GDPR?
Article 5(1) says personal data shall be processed according to six named principles, and Article 5(2) says the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1. The names in the first column are the names Article 5 places in quotation marks.
| Name in Article 5 | Provision | What the article says |
|---|---|---|
| Lawfulness, fairness and transparency | Article 5(1)(a) | Processed lawfully, fairly and in a transparent manner in relation to the data subject. |
| Purpose limitation | Article 5(1)(b) | Collected for specified, explicit and legitimate purposes and not further processed in a way that is incompatible with those purposes, with the Article 89(1) rule for archiving, research and statistics. |
| Data minimisation | Article 5(1)(c) | Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. |
| Accuracy | Article 5(1)(d) | Accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay. |
| Storage limitation | Article 5(1)(e) | Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed, with the longer-storage rule below. |
| Integrity and confidentiality | Article 5(1)(f) | Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. |
| Accountability | Article 5(2) | The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1. |
Point (a) requires processing to be lawful. It does not itself list the lawful bases. Those are Article 6. See The EU GDPR Explained.
What is purpose limitation?
Under Article 5(1)(b), personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The same point then says that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes. Article 5 stops at that sentence. It does not say that every new purpose needs a fresh consent.
How long may personal data be kept?
Article 5(1)(e) requires personal data to be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. It then permits longer storage insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject. Article 5(1)(e) does not set a number of days, months or years.
Accuracy sits beside that limit. Article 5(1)(d) requires personal data to be accurate and, where necessary, kept up to date, and every reasonable step to ensure that inaccurate personal data are erased or rectified without delay, having regard to the purposes for which they are processed.
What does integrity and confidentiality require?
Article 5(1)(f) requires personal data to be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. The article says "technical or organisational measures". It does not list particular tools.
What is the accountability principle?
Article 5(2) says the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1. That is the whole of the accountability rule in Article 5. Records of processing activities and impact assessments are separate articles. This guide does not restate them. A record of processing activities is covered in Record of Processing Activities (RoPA) GDPR Article 30 Requirements, and a data protection impact assessment in When is a Data Protection Impact Assessment (DPIA) required under the GDPR?.
How was this guide checked?
Each legal sentence was checked against the English text of Article 5 of Regulation (EU) 2016/679 in OJ L 119, 4.5.2016. The text used was the Publications Office HTML of that Official Journal. No text outside Article 5 is a source for this page. The responsible organisation is GDPR Exam Trainer. This is a study guide, not legal advice.
Frequently asked questions
These answers stay inside Article 5.
What are the 7 principles of the GDPR?
Article 5(1) lists six rules for personal data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. Article 5(2) adds accountability: the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1. Counted together, that is the seven-part list. The Regulation does not use the number seven.
What is the accountability principle?
Article 5(2) says the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1. Paragraph 1 is the six processing rules. Article 5(2) does not name a particular record or assessment.
What does data minimisation require?
Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Does purpose limitation ban every new use?
Article 5(1)(b) requires collection for specified, explicit and legitimate purposes and says personal data shall not be further processed in a manner that is incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered incompatible with the initial purposes.