Article 5 sets out the core principles that must be followed when processing personal data. These principles form the foundation of data protection law and guide how organisations must handle personal information responsibly.
The six key principles are: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality (security). Together, these principles ensure that data is collected for clear reasons, kept accurate and secure, and not stored longer than necessary.
Article 5 also introduces the principle of accountability, meaning organisations must not only follow these rules but also be able to demonstrate compliance. This encourages responsible data management and strengthens protection for individuals.
| Principle | Summary | Notes / Examples |
|---|---|---|
| Lawfulness, fairness, and transparency | Data must be processed legally, fairly, and in a transparent manner. | Informing users how their data is used; complying with GDPR legal bases. |
| Purpose limitation | Data must be collected for specified, explicit, and legitimate purposes only. | Using customer emails only for delivery updates, not marketing without consent. |
| Data minimisation | Only collect personal data that is adequate, relevant, and limited to what is necessary. | Don’t ask for unnecessary info like marital status for newsletter sign-up. |
| Accuracy | Ensure personal data is accurate and up-to-date; correct inaccuracies without delay. | Allow users to update contact info; correct errors in databases. |
| Storage limitation | Keep personal data only as long as necessary for the purposes it was collected. | Delete old employee records after statutory retention period. |
| Integrity and confidentiality (security) | Data must be processed securely to prevent loss, unauthorized access, or damage. | Use encryption, access controls, and secure storage systems. |
| Accountability | Controllers are responsible for compliance and must demonstrate it. | Maintain records of processing activities, audits, and policies. |
Article 1 – Article 2, Article 3, Article 4, Article 5, Article 6, Article 7 , Article 8