EdLaw
Principles relating to processing of personal data
The processing principles that all other obligations hang off — lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, and the accountability principle — plus the further-processing compatibility rules that elaborate purpose limitation.
Article 5 — Principles relating to processing of personal data
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
- (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
- (b) collected (whether from the data subject or otherwise) for specified, explicit and legitimate purposes and not further processed by or on behalf of a controller in a manner that is incompatible with the purposes for which the controller collected the data (‘purpose limitation’);
- (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
- (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
- (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 84B (‘storage limitation’);
- (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
3. For the avoidance of doubt, processing is not lawful by virtue only of being processing in a manner that is compatible with the purposes for which the personal data was collected.
Article 8A — Purpose limitation: further processing
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
1. This Article is about the determination, for the purposes of Article 5(1)(b) (purpose limitation), of whether processing of personal data by or on behalf of a controller for a purpose (a “new purpose”) other than the purpose for which the controller collected the data (“the original purpose”) is processing in a manner compatible with the original purpose.
- (a) any link between the original purpose and the new purpose;
- (b) the context in which the personal data was collected, including the relationship between the data subject and the controller;
- (c) the nature of the processing, including whether it is processing described in Article 9(1) (processing of special categories of personal data) or Article 10(1) (processing of personal data relating to criminal convictions etc);
- (d) the possible consequences of the intended processing for data subjects;
- (e) the existence of appropriate safeguards (for example, encryption or pseudonymisation).
3. Processing of personal data for a new purpose is to be treated as processing in a manner compatible with the original purpose where—
- (a) the data subject consents to the processing of personal data for the new purpose and the new purpose is specified, explicit and legitimate,
- (b) the processing is carried out in accordance with Article 84B—
- (c) the processing is carried out for the purposes of ensuring that processing of personal data complies with Article 5(1) or demonstrating that it does so,
- (d) the processing meets a condition in Annex 2, or
- (e) the processing is necessary to safeguard an objective listed in Article 23(1)(c) to (j) and is authorised by an enactment or rule of law or by relevant international law (see section 9A of the 2018 Act).
4. Where the controller collected the personal data based on Article 6(1)(a) (data subject’s consent), processing for a new purpose is only processing in a manner compatible with the original purpose if—
- (a) it falls within paragraph 3(a) or (c), or
- (b) it falls within paragraph 3(d) or (e) and the controller cannot reasonably be expected to obtain the data subject’s consent.
- (a) adding or varying provisions, or
- (b) omitting provisions added by regulations made under this paragraph.
6. The Secretary of State may only make regulations under paragraph 5 adding a case to Annex 2 where the Secretary of State considers that processing in that case is necessary to safeguard an objective listed in Article 23(1)(c) to (j).
7. Regulations under paragraph 5 may make provision identifying processing by any means, including by reference to the controller, the data subject, the personal data or the provision of Article 6(1) relied on for the purposes of the processing.
Sources
- legislation.gov.uk — UK GDPR (Regulation (EU) 2016/679 as retained), consolidated text
- ICO — UK GDPR guidance and resources
Meta
All article text above is reproduced verbatim from the consolidated UK GDPR on legislation.gov.uk, extracted mechanically from the official XML. Repealed or omitted text appears as "..." exactly as published. Amendment history is available via each article link. Each provision carries its official identifier as a trailing attribute anchor (e.g. {#article-35-2}, attributes syntax) — the same id legislation.gov.uk uses, so .../eur/2016/679/article/35/2 at the source corresponds to #article-35-2 here.