Article 5 of the GDPR lists the principles that apply to every instance of processing. They are the basis of all the other rules: if you remember them, you can settle many doubtful cases yourself.
The seven principles
- Lawfulness, fairness and transparency. Data is processed on a basis provided for by law, fairly and by telling people what happens to their data.
- Purpose limitation. Data is collected for specified and legitimate purposes and is not later used for incompatible ones.
- Data minimisation. Only data that is adequate, relevant and limited to what is needed is used.
- Accuracy. Data must be correct and, where necessary, kept up to date. Wrong data must be corrected or deleted without delay.
- Storage limitation. Data is kept only as long as necessary for the purpose, then deleted or anonymised.
- Integrity and confidentiality. Data must be protected against unauthorised access, loss and destruction by appropriate measures.
- Accountability (Article 5(2)). The controller must comply with the principles and be able to demonstrate it.
Examples from everyday work
- Purpose. The customer list is there to carry out orders. Using it to send personal greetings or to advertise another business is not the same thing.
- Minimisation. To book a table, a name and a phone number are enough. Asking for a date of birth and an address as well is too much.
- Accuracy. If a customer gives you a new number, update it wherever it is needed, not just in your own spreadsheet.
- Storage. Copies of documents, printed sheets and network folders must not be kept for ever "to be safe". The company should decide how long to keep each category.
- Confidentiality. A document containing personal data does not stay on a desk where anyone passing can see it.
Data protection by design
Article 25 GDPR asks the controller to think about data protection by design and by default. A new form, app or procedure should by default collect only the data it needs. If you take part in choosing a new tool, ask yourself: what data does it collect? Who sees it? How long does it stay?
Not everything is allowed "because it is convenient"
The fact that information is within reach does not mean you may use it for any purpose. Looking up the data of a colleague, a neighbour or a well-known person out of curiosity is not part of the job: it breaches the principles of purpose and confidentiality.
The record of processing activities
The controller describes its processing in the record of processing activities (Article 30 GDPR): which data, about whom, for what purpose, for how long, to whom it is disclosed. There is an exception for businesses with fewer than 250 employees, but it does not apply if the processing poses a risk to people's rights, is not occasional or involves special categories of data. A company with staff will normally carry out non-occasional processing anyway, so it keeps the record. This is the employer's task, not yours, but you can help by reporting it when you use a new type of data or a new tool.
To remember
- Clear purpose, little data, correct data, limited time, protection.
- The controller must also be able to demonstrate it with procedures and documents.