All the rules on personal data are built on a few basic principles. They are in Article 5 of the General Data Protection Regulation. If you know them, you can work out most everyday situations, even those nobody has written rules for.
1. Lawfulness, fairness and transparency
Processing must have a valid basis (see the next lesson), be fair to the person and be open. People must be able to understand what happens to their information. That is why the company must provide information, for example in a privacy notice.
2. Purpose limitation
Information must be collected for specified, explicit and legitimate purposes. It must not later be used in a way that is incompatible with that purpose. If a customer has given their email address to get a receipt, you may not simply use it for a newsletter.
3. Data minimisation
Information must be adequate, relevant and limited to what is necessary. Ask only for what you need. You do not need the customer's date of birth to send a parcel.
4. Accuracy
Information must be correct and, where necessary, kept up to date. Inaccurate information must be corrected or deleted without undue delay. A wrong address can send a bill or a reply from the doctor to a stranger.
5. Storage limitation
Information must not be kept longer than necessary for the purpose. When the purpose has been fulfilled and no law requires you to keep it, it must be deleted or anonymised. Some rules, on the contrary, require you to keep information, for example accounting records must be kept for 5 years after the end of the financial year they relate to (bogføringsloven § 12, the Danish Bookkeeping Act). The company should have fixed deletion deadlines, and you must follow them.
6. Integrity and confidentiality
Information must be protected against unauthorised or unlawful processing and against accidental loss, destruction or damage. That requires appropriate technical and organisational measures. Most of them are your daily work: a locked screen, strong passwords, the right recipient on the email.
7. Accountability
The controller must not only comply with the principles but also be able to demonstrate it (Article 5(2)). That is why the company writes policies, keeps records and documents its choices. You help by following the procedures and by speaking up when something does not work in practice.
Data protection by design
Article 25 requires data protection by design and by default. New systems and processes must be set up from the start so that they use only the information that is necessary. If you help choose a new tool or a new form, think about this.
An everyday example
An employee of an association has a member list for sending membership fee invoices. A colleague asks for the list to invite people to a private event. Purpose limitation says no: the list was collected for invoicing. Data minimisation says that an invitation to a meeting needs only a name and email, not an address and date of birth. And storage limitation says that the list of former members should not be kept for ever.
Rule of thumb: Keep and share only the information you need. Use it only for what it was collected for. Delete it when it is no longer needed.