We want to use data collected for invoicing for something else as well. Is that allowed?

Paragraph 1(b) says data may not be further processed in a manner incompatible with the original purpose. A new purpose is therefore not automatically prohibited, but you must assess whether it is compatible with the purpose for which you collected the data. Under paragraph 1(b) read with Article 89(1), further processing for archiving in the public interest, scientific or historical research or statistics is not considered incompatible.

How long may we keep personal data?

Article 5 sets no fixed period. Paragraph 1(e) says you keep data in identifiable form no longer than necessary for the purpose. Recital 39 therefore asks the controller to set time limits for erasure or for periodic review. Longer storage is allowed only for archiving, research or statistics with appropriate safeguards.

What does accountability mean in concrete terms?

Paragraph 2 places two things on the controller: it is responsible for compliance with the principles of paragraph 1 and it must be able to demonstrate that compliance. Following the rules is therefore not enough; you must also be able to show how you do so, for example with documented purposes, retention periods and security measures.

Article 5: Principles relating to processing of personal dataAI-relevant

Praxikon tracks Article 5 (Principles relating to processing of personal data) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIn force since 25-05-2018

Article 5 contains the six principles that every processing of personal data must meet: lawfulness, fairness and transparency (paragraph 1(a)), purpose limitation (b), data minimisation (c), accuracy (d), storage limitation (e) and integrity and confidentiality (f). Paragraph 2 adds accountability: the controller is responsible for compliance with those principles and must be able to demonstrate it. The article exists because the rest of the Regulation works out these principles in detail; whoever knows them understands the logic behind all the other obligations. Recital 39 explains what the principles mean in practice, such as understandable information, keeping storage to a strict minimum and setting time limits for erasure.

Key term: Accountability: the controller must not only comply with the principles but also be able to demonstrate that compliance (paragraph 2)

Directly affects:controllerprocessordata subjectdata protection officer

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

GDPR principles (purpose limitation, minimisation, accuracy) are directly relevant for AI training data under AI Act Art. 10 (data governance).

AI Act Art. 10 →

Official text

Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Test every processing operation against the six principles of paragraph 1 and record how you meet them, because paragraph 2 requires you to be able to demonstrate compliance. Define the purpose of each processing operation in advance (paragraph 1(b)), collect no more than necessary (c) and, as recital 39 asks, set time limits for erasing data or reviewing them periodically (e). If you train an AI model on customer data, for example, the same rule applies: use only the data necessary for that purpose.

Processor

Even when you process on behalf of someone else, the data must remain accurate, secure and limited to the purpose (paragraph 1(b), (d) and (f)). Make sure you can help the controller demonstrate compliance (paragraph 2), for example by recording which security measures you have in place.

Data Protection Officer

Use the six principles as a standard test for every new project and pay particular attention to purpose limitation (paragraph 1(b)) and storage limitation (e). Check that the organisation can actually demonstrate compliance (paragraph 2) rather than merely claim it.

Data Subject

You can expect an organisation to tell you in plain language what it does with your data (paragraph 1(a) and recital 39), to collect no more than necessary and to keep your data no longer than needed. If your data are inaccurate, the organisation must take every reasonable step to erase or correct them (paragraph 1(d)).

Compliance checklist

Every processing operation has a purpose that was specified, explicit and legitimate before processing began (Article 5(1)(b)).For each processing operation it has been checked that only data necessary for that purpose are collected (Article 5(1)(c)).There is a procedure for correcting or erasing inaccurate personal data without delay (Article 5(1)(d)).A retention period or periodic review is set for each category of personal data (Article 5(1)(e) and recital 39).Appropriate technical and organisational security measures are in place against unauthorised processing, loss and damage (Article 5(1)(f)).Data subjects are informed about the processing in a transparent manner (Article 5(1)(a)).The organisation can demonstrate with documentation that the principles of paragraph 1 are complied with (Article 5(2)).

Related recitals

(39)

Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to w...

Cross-references

Art. 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (13)

18 June 2026 · C-484/24 · CJEU
NTH Haustechnik
A court using evidence containing personal data processes it under a legal obligation, provided clear national case law sets the conditions. Unlawfully obtained evidence is not automatically excluded, but before disclosing it further the court must limit the data to what is necessary.
13 March 2025 · C-247/23 · CJEU
Deldits
A public register must rectify an inaccurate entry of gender identity. Reasonable evidence may be required, but not proof of gender reassignment surgery.
19 December 2024 · C-65/23 · CJEU
MK v K GmbH
A collective or works agreement on employee data must also comply with Articles 5, 6 and 9 of the GDPR, and courts fully review its necessity.
11 January 2024 · C-231/22 · CJEU
État belge (Moniteur belge)
An official journal can be a controller where national law determines the purposes and means of publication. It is then itself responsible for the Article 5 principles, unless national law creates joint responsibility.
14 December 2023 · C-340/21 · CJEU
Natsionalna agentsia za prihodite
A successful hack does not in itself prove that security fell short; the court assesses the measures concretely and the controller must prove they were appropriate. Fear of misuse can be non-material damage.

Show 8 more

7 December 2023 · C-26/22, C-64/22 · CJEU
SCHUFA (debt discharge)
A credit agency may not keep data on a debt discharge longer than the public register does. A supervisory authority's decision on a complaint is subject to full judicial review.
4 May 2023 · C-60/22 · CJEU
UZ v Bundesrepublik Deutschland
The absence of a joint controller arrangement or of a record of processing does not in itself make processing unlawful, so it gives no right to erasure or restriction.
2 March 2023 · C-268/21 · CJEU
Norra Stockholm Bygg
The GDPR also applies where a civil court orders a staff register to be produced as evidence. The court must weigh the interests of the data subjects and apply data minimisation, for instance through pseudonymisation.
27 October 2022 · C-129/21 · CJEU
Proximus
Inclusion in public telephone directories requires consent within the meaning of the GDPR. A request to be removed from directories is an exercise of the right to erasure, and the directory provider must take reasonable steps to inform other providers and search engines.
20 October 2022 · C-77/21 · CJEU
Digi
Copying customer data into a test database can be compatible further processing, but the data may not stay there longer than needed for testing and fixing errors.
24 February 2022 · C-175/20 · CJEU
Valsts ieņēmumu dienests
A large-scale information request by a tax authority falls under the GDPR and must respect the Article 5 principles. Derogations require a legislative measure within the meaning of Article 23.
22 June 2021 · C-439/19 · CJEU
Latvijas Republikas Saeima
Penalty points for traffic offences are criminal offence data. A law that makes them available to anyone without a specific interest, or passes them to businesses for re-use, breaches the GDPR.
11 December 2019 · C-708/18 · CJEUDirective 95/46
TK v Asociaţia de Proprietari
CCTV in the common areas of an apartment building can rely on legitimate interests without consent, provided the conditions of that basis are met.

Guidelines and decisions (5)

13 October 2026 · Statement 1/2026 · EDPB
Statement 1/2026 on smart glasses
Preliminary reflections: a narrow exemption for purely personal use, the producer and the provider of a linked service (including AI) can be controllers, and bystanders must notice at that moment that recording is taking place.
19 November 2025 · COM(2025) 837 · European Commission
Digital Omnibus: proposal amending the GDPR
Legislative proposal that would introduce, among other things, a relative definition of personal data, breach notification only for high risk and cookie rules within the GDPR itself. It is a proposal, not law in force.
14 February 2023 · v2.0 · EDPB
Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them
Describes types of deceptive design patterns in social media interfaces and how they conflict with the GDPR, with practical recommendations for designers.
9 March 2021 · v2.0 · EDPB
Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications
Addresses data protection for connected vehicles and mobility apps, such as location data, biometrics and access to data stored in the vehicle.
2 April 2013 · WP203 (Opinion 03/2013) · Article 29 Working PartyDirective 95/46
Opinion 03/2013 on purpose limitation
Elaborates the purpose limitation principle, covering the requirement of specified purposes and the factors for testing whether further processing is compatible.

Fines (10)

26 November 2024 · Dutch Data Protection Authority€4,750,000
Netflix: unclear information to customers
Between 2018 and 2020 Netflix's privacy statement and its replies to access requests did not clearly explain the purposes and legal bases of its processing, who data were shared with, how long data were kept, and how transfers outside Europe were safeguarded.
Decision of 26 November 2024, announced on 18 December 2024. Netflix objected to the fine.
22 October 2024 · Data Protection Commission (Ireland)€310,000,000
LinkedIn: behavioural analysis and targeted advertising
LinkedIn used members' data for behavioural analysis and targeted advertising without a valid legal basis: consent was not valid, and neither legitimate interest nor contract applied. Members were also not properly informed about the legal bases relied on.
Decision of 22 October 2024, announced on 24 October 2024. LinkedIn appealed to the Irish High Court.
16 May 2024 · Dutch Data Protection Authority€30,500,000
Clearview AI: illegal database of face prints
Clearview scraped billions of photos from the internet and turned faces into biometric codes, without a legal basis and in breach of the ban on processing biometric data. It did not inform people, ignored access requests and had no representative in the EU.
Decision of 16 May 2024, announced on 3 September 2024. Clearview did not object, so the fine is final. The AP imposed no separate fine for the missing EU representative (Article 27).
1 September 2023 · Data Protection Commission (Ireland)€345,000,000
TikTok: children's accounts public by default
Children's accounts were public by default and the Family Pairing feature was poorly safeguarded, while children were not properly informed. At the EDPB's direction, deceptive design choices were also found to breach the fairness principle.
Decision of 1 September 2023, announced on 15 September 2023. TikTok challenged the decision before the EU General Court (case T-1030/23) and the Irish High Court.
31 December 2022 · Data Protection Commission (Ireland)€390,000,000
Meta: contract as legal basis for behavioural advertising
Meta relied on its terms of service as the legal basis for behavioural advertising on Facebook and Instagram, which the binding EDPB decision held was not a valid basis. Users were also not clearly told which legal basis applied to which processing.
Two decisions of 31 December 2022 (EUR 210 million for Facebook, EUR 180 million for Instagram), announced on 4 January 2023. Meta announced it would appeal both the substance and the fines.

Show 5 more

2 September 2022 · Data Protection Commission (Ireland)€405,000,000
Instagram: children's data public by default
Children aged 13 to 17 could run business accounts that published their email address or phone number, and children's personal accounts were public by default. At the EDPB's direction, an infringement of the legal basis for processing was also found.
Decision of 2 September 2022, announced on 15 September 2022. Meta appealed to the Irish High Court.
25 November 2021 · Dutch Data Protection Authority€2,750,000
Tax Administration: nationality in childcare benefits
For years the Benefits department unlawfully kept the dual nationality of Dutch citizens and used applicants' nationality in a risk model and in fraud detection for childcare benefits, although this was not necessary. The processing was unlawful and, being discriminatory, also unfair.
Decision of 25 November 2021, announced on 7 December 2021. The Tax Administration said it would not object.
20 August 2021 · Data Protection Commission (Ireland)€225,000,000
WhatsApp: insufficient transparency
WhatsApp did not properly inform users and non-users about the processing of their data, including the sharing of data with other Facebook companies. Following a binding EDPB decision the DPC had to increase its proposed fine.
The DPC lists 20 August 2021 as the decision date; announced on 2 September 2021. WhatsApp challenged the decision in the Irish courts and before the EU General Court.
1 October 2020 · HmbBfDI (Hamburg)€35,258,708
H&M: recording employees' private lives
For years, managers at the Nuremberg service centre kept extensive notes on the private lives of hundreds of employees, including illnesses, holidays, family problems and religion. The data were used to build profiles and inform employment decisions.
The date is the date of the press release; according to reports H&M did not object, so the fine is final.
20 December 2019 · Dutch Data Protection Authority€525,000
KNLTB: member data provided to sponsors
In 2018 the tennis association provided members' personal data for payment to two sponsors, who then approached the members with advertising. The AP found there was no valid legal basis and, for part of the members, an incompatible further use of the data.
Decision of 20 December 2019, announced on 3 March 2020. After the Court of Justice judgment (C-621/22, 4 October 2024), the AP and KNLTB agreed in October 2025 to end the proceedings; the AP is reducing the fine to EUR 250,000, minus the cost of an awareness campaign. A final new fining decision was announced for June 2026 at the latest but was not found.

Line of case lawLegitimate interests and contract

When may you process without consent?

Rīgas satiksme (2017)Three cumulative conditions for legitimate interests.
Fashion ID (2019)In joint control each party needs its own legitimate interest.
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects (2019)Necessary for the contract is an objective test.
Meta Platforms v Bundeskartellamt (2023)Personalised advertising is not necessary for the contract.
KNLTB (2024)A commercial interest can be legitimate, but necessity stays strict.
Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (2024)The EDPB works out the three steps in guidelines.
Mousse (2025)The interest must have been communicated at collection.

Checked on 5 November 2026

Frequently asked questions

← Art. 4: Definitions Art. 6: Lawfulness of processing →

Connections

Themes where this returns

Where this meets the other law

Further processing of personal data in the AI regulatory sandbox: Article 59
own ground for further processing alongside

The counterpart in the other law