Article 5 GDPR sets out the basic principles. Every processing of personal data must meet them. For everyday work, the following matter most.
Seven principles
- Lawfulness, fairness and transparency. Data is processed according to the law, honestly, and in a way that lets people know what is happening to their data.
- Purpose limitation. Data is collected for a specified, explicit and legitimate purpose. It must not then be used for something unrelated. The address from an order is for delivery, not for advertising the customer did not ask for.
- Data minimisation. Collect only what is necessary for the purpose. To register at a library you do not need marital status.
- Accuracy. Data should be correct and up to date. Inaccurate data is corrected or erased.
- Storage limitation. Data is kept only as long as the purpose requires. Then it is erased or anonymised. Some periods are set by law, for example the archiving of payroll records.
- Integrity and confidentiality. Data is protected against unauthorised access, loss and damage.
- Accountability. The controller must be able to demonstrate that it follows the principles. That is why records, policies and written instructions are kept.
What it looks like in practice
Example 1 – purpose. A company collected employees' phone numbers in case of an emergency. It must not use them for invitations to a business partner's private event.
Example 2 – minimisation. A newsletter form needs an e-mail address. Date of birth and address are not needed, so do not ask for them.
Example 3 – storage limitation. The CVs of unsuccessful candidates must not be kept indefinitely. The employer should set a period and delete them afterwards, or ask for consent to keep them longer.
Example 4 – confidentiality. A spreadsheet of salaries is not shared by e-mail with the whole department. It goes only to those who need it.
Data protection by design and by default
Article 25 GDPR requires systems to be set up so that by default they process only the necessary data and only authorised people have access. When you create a form, spreadsheet or list yourself, follow the same approach: nothing extra, access only for those who need it.
Anonymisation and pseudonymisation
Anonymised data can no longer be linked to any person, even with the help of other information. The GDPR does not apply to such data (recital 26). Pseudonymisation merely replaces a name with a code or number (Article 4(5)). Whoever holds the key can identify the person again, so it is still personal data. A table with employee numbers instead of names is therefore not anonymous.
The "need to know" principle
Even inside a company, data is seen only by those who need it for their work. Having technical access to a system does not mean you may open the data. Looking into the record of a colleague, a neighbour or an acquaintance out of curiosity is unauthorised processing.
What to do when you are not sure
- Ask your supervisor or the data protection officer, if the company has appointed one.
- Do not collect or share data "just in case".
- If in doubt, do not send the data and wait for an answer.
What to remember
- Data only for a specified purpose, only to the necessary extent and only for the necessary time.
- The controller must be able to demonstrate compliance with the principles.
- Access to a system is not permission to look at data without a work reason.
An example from the office
A colleague in HR wants to know who in the team is ill so that she can arrange cover. She needs only to know that the colleague will not be at work, not the diagnosis. In the same way, a manager needs to know who is present today, but not why someone is absent. Always ask: Do I really need this data for the purpose? If not, do not ask for it and do not share it.