GDPR Article 5: principles relating to processing of personal data

Article 5 is the shortest route to understanding what the GDPR is actually asking of you. Almost every other obligation in the Regulation is a mechanism for delivering one of these principles, and enforcement decisions routinely cite Article 5 alongside whatever specific article was breached.

The six principles in Article 5(1)

The article opens with three words that set the frame: personal data shall be. What follows are conditions on the data itself, not merely on your paperwork.

(a) Lawfulness, fairness and transparency. Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Lawfulness points to Article 6; fairness and transparency are separate tests that a technically valid lawful basis does not satisfy on its own.

(b) Purpose limitation. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The text adds that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered incompatible with the initial purposes.

Note "incompatible", not "different". The principle does not freeze data to a single use; it bars uses that conflict with the one you declared.

(c) Data minimisation. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Three tests, and "adequate" runs in the opposite direction from the other two: collecting too little to do the job properly is also a failure.

(d) Accuracy. Accurate and, where necessary, kept up to date, with every reasonable step taken to ensure that inaccurate personal data are erased or rectified without delay, having regard to the purposes. The standard is tied to purpose, so an outdated address matters more in a billing system than in an archived support log.

(e) Storage limitation. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes. Longer storage is allowed insofar as the data will be processed solely for Article 89(1) purposes, subject to appropriate technical and organisational measures.

The wording is precise and often misread. The principle limits how long you keep data in an identifiable form, which is why anonymisation is an alternative to deletion.

(f) Integrity and confidentiality. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. This is the principle that Article 32 then builds out in detail.

The seventh: accountability

Article 5(2): the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1.

That short sentence changes the character of the whole Regulation. Under it, doing the right thing and being unable to evidence it is a compliance failure. It is why the record of processing activities exists, why impact assessments are written down, and why "we have always deleted old accounts" is a weaker answer than a retention schedule with dated reviews.

Why the principles get cited in enforcement

Regulators reach for Article 5 because it applies to the whole of a processing operation rather than to one step. A retention failure is Article 5(1)(e). Collecting more than you need is Article 5(1)(c). A breach caused by weak controls is Article 5(1)(f) as well as Article 32. And in most decisions Article 5(2) comes along too, because a controller that cannot produce documentation has failed the accountability principle regardless of what it actually did.

A practical way to use them

Take one processing activity, in a real system, and answer six questions about it. What is the purpose, and where did we state it. What is the lawful basis. Which fields are genuinely necessary for that purpose. How do we correct data that is wrong. When does this data stop being identifiable. What protects it. Then ask the seventh: where is the evidence of all of the above.

Teams that run this on their three highest-volume data flows usually find the same two gaps, retention and minimisation, and those are exactly the gaps that show up in enforcement.

Article 5(1)(e) storage limitation, in full

Storage limitation is the principle most often paraphrased into something narrower than it says. The official consolidated text of Article 5(1)(e) requires personal data to be:

"kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation')."

Three things follow that a shorter summary loses.

The limit is on the form, not on the record. The obligation is to stop keeping data "in a form which permits identification", so anonymising a dataset satisfies the principle as well as deleting it does. Pseudonymisation does not, because pseudonymous data still permits identification with additional information.

The clock is set by purpose, not by a fixed period. Article 5(1)(e) names no number of years. A retention schedule is how you evidence the judgement; it is not itself the standard.

The archiving extension is conditional and narrow. Longer storage is permitted only where the data will be processed solely for public-interest archiving, scientific or historical research, or statistical purposes, in accordance with Article 89(1), and only with the safeguards that Article requires. "We might want it for analysis later" does not meet that test.

How the principles interlock

Article 5(1)(b) purpose limitation and Article 5(1)(e) storage limitation are the same idea at two points in time. Purpose limitation controls what you may do with data once you hold it; storage limitation controls how long holding it stays justified. Both run off the purposes you specified at collection, which is why an imprecise purpose statement weakens two principles at once.

Article 5(1)(b) carries the same research carve-out, providing that further processing for public-interest archiving, scientific or historical research or statistical purposes, in accordance with Article 89(1), shall not be considered incompatible with the initial purposes.

Next step

The principles apply to whoever is in scope, and scope is where most businesses guess. The free 2-minute Obligation Scan checks your business against GDPR and every US state privacy law at once and tells you which obligations actually reach you. For the lawful basis question underneath Article 5(1)(a), see GDPR Article 6, and for the surrounding duties see the GDPR compliance pillar.