We want to use data collected for invoicing for something else as well. Is that allowed?

Paragraph 1(b) says data may not be further processed in a manner incompatible with the original purpose. A new purpose is therefore not automatically prohibited, but you must assess whether it is compatible with the purpose for which you collected the data. Under paragraph 1(b) read with Article 89(1), further processing for archiving in the public interest, scientific or historical research or statistics is not considered incompatible.

How long may we keep personal data?

Article 5 sets no fixed period. Paragraph 1(e) says you keep data in identifiable form no longer than necessary for the purpose. Recital 39 therefore asks the controller to set time limits for erasure or for periodic review. Longer storage is allowed only for archiving, research or statistics with appropriate safeguards.

What does accountability mean in concrete terms?

Paragraph 2 places two things on the controller: it is responsible for compliance with the principles of paragraph 1 and it must be able to demonstrate that compliance. Following the rules is therefore not enough; you must also be able to show how you do so, for example with documented purposes, retention periods and security measures.

Article 5: Principles relating to processing of personal dataAI-relevant

Praxikon tracks Article 5 (Principles relating to processing of personal data) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIn force since 25-05-2018

Article 5 contains the six principles that every processing of personal data must meet: lawfulness, fairness and transparency (paragraph 1(a)), purpose limitation (b), data minimisation (c), accuracy (d), storage limitation (e) and integrity and confidentiality (f). Paragraph 2 adds accountability: the controller is responsible for compliance with those principles and must be able to demonstrate it. The article exists because the rest of the Regulation works out these principles in detail; whoever knows them understands the logic behind all the other obligations. Recital 39 explains what the principles mean in practice, such as understandable information, keeping storage to a strict minimum and setting time limits for erasure.

Key term: Accountability: the controller must not only comply with the principles but also be able to demonstrate that compliance (paragraph 2)

Directly affects:controllerprocessordata subjectdata protection officer

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

GDPR principles (purpose limitation, minimisation, accuracy) are directly relevant for AI training data under AI Act Art. 10 (data governance).

AI Act Art. 10 →

Official text

Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Test every processing operation against the six principles of paragraph 1 and record how you meet them, because paragraph 2 requires you to be able to demonstrate compliance. Define the purpose of each processing operation in advance (paragraph 1(b)), collect no more than necessary (c) and, as recital 39 asks, set time limits for erasing data or reviewing them periodically (e). If you train an AI model on customer data, for example, the same rule applies: use only the data necessary for that purpose.

Processor

Even when you process on behalf of someone else, the data must remain accurate, secure and limited to the purpose (paragraph 1(b), (d) and (f)). Make sure you can help the controller demonstrate compliance (paragraph 2), for example by recording which security measures you have in place.

Data Protection Officer

Use the six principles as a standard test for every new project and pay particular attention to purpose limitation (paragraph 1(b)) and storage limitation (e). Check that the organisation can actually demonstrate compliance (paragraph 2) rather than merely claim it.

Data Subject

You can expect an organisation to tell you in plain language what it does with your data (paragraph 1(a) and recital 39), to collect no more than necessary and to keep your data no longer than needed. If your data are inaccurate, the organisation must take every reasonable step to erase or correct them (paragraph 1(d)).

Compliance checklist

Every processing operation has a purpose that was specified, explicit and legitimate before processing began (Article 5(1)(b)).For each processing operation it has been checked that only data necessary for that purpose are collected (Article 5(1)(c)).There is a procedure for correcting or erasing inaccurate personal data without delay (Article 5(1)(d)).A retention period or periodic review is set for each category of personal data (Article 5(1)(e) and recital 39).Appropriate technical and organisational security measures are in place against unauthorised processing, loss and damage (Article 5(1)(f)).Data subjects are informed about the processing in a transparent manner (Article 5(1)(a)).The organisation can demonstrate with documentation that the principles of paragraph 1 are complied with (Article 5(2)).

Related recitals

(39)

Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to w...

Cross-references

Art. 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

Frequently asked questions

← Art. 4: Definitions Art. 6: Lawfulness of processing →

Connections

Themes where this returns

The counterpart in the other law