GDPR Principles Art5

GDPR Article 5: Core Principles of Data Processing
Article 5 of the General Data Protection Regulation establishes the foundational principles governing all personal data processing. These principles function as normative anchors—they inform the interpretation of every other GDPR provision and apply horizontally across all processing activities, regardless of the legal basis relied upon. Supervisory authorities and courts consistently treat Article 5 as the primary benchmark for enforcement, making a thorough understanding of its requirements essential for any data protection practitioner.
Structure of Article 5
Two Core Components
Article 5(1) — Substantive Principles
(a) Lawfulness, fairness, transparency
(b) Purpose limitation
(c) Data minimisation
(d) Accuracy
(e) Storage limitation
(f) Integrity and confidentiality
Article 5(2) — Accountability Principle
The controller bears direct responsibility for compliance with each of the six substantive principles and must be able to demonstrate that compliance at any time.
Article 5(2) transforms the principles from abstract norms into operational compliance duties—failure to evidence compliance is itself a breach.
Lawfulness, Fairness & Transparency
Article 5(1)(a)
Lawfulness
Processing must rely on a valid legal basis under Article 6 (and Article 9 where special category data is involved). No basis, no lawful processing—regardless of intent.
Fairness
Extends beyond mere legality. Requires that processing causes no unjustified adverse effects and aligns with the reasonable expectations of data subjects. Increasingly invoked in AI and algorithmic decision-making cases, often independently of any transparency breach.
Transparency
Demands clear, accessible and timely information as required by Articles 12–14. Opaque, deceptive or layered practices that obscure the true nature of processing will constitute a breach of this principle.
Purpose Limitation
Article 5(1)(b)
Data must be collected for specified, explicit, and legitimate purposes and must not be further processed in a manner incompatible with those purposes. Where further processing is contemplated, Article 6(4) sets out a structured compatibility test.
Further processing for scientific, historical, or statistical research may be considered compatible provided appropriate safeguards are in place, including data minimisation and access controls.
Data Minimisation
Article 5(1)(c)
Personal data must be adequate (sufficient for the stated purpose), relevant, and strictly limited to what is necessary. The necessity test is rigorous—convenience or commercial preference does not justify collection.
Operational Implications
Regular data audits and mapping exercises
Field-level justification for each data element collected
Periodic review and deletion of data no longer necessary
Advanced Tension: Big data analytics often derive value from large, diverse datasets—directly in conflict with the minimisation principle. Controllers must document the justification for each data element with care.
Accuracy
Article 5(1)(d)
Credit Scoring
Inaccurate financial data can directly harm individuals through incorrect creditworthiness assessments, with serious legal and financial consequences.
Law Enforcement
Erroneous records in police or criminal justice databases carry the most severe human consequences, including wrongful identification or arrest.
Automated Decisions
Under Article 22, decisions based solely on automated processing must be grounded in accurate data—inaccuracy can render such decisions unlawful.
Risk Insight: Inaccurate data does not merely expose a controller to a rectification request—it can transform otherwise lawful processing into unlawful processing, triggering broader enforcement liability.
Storage Limitation & Integrity and Confidentiality
Articles 5(1)(e) and 5(1)(f)
Storage Limitation — Article 5(1)(e)
Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it was collected.
Defined, documented retention schedules
Clear justification for any extended storage
Anonymisation as an alternative to deletion
Integrity & Confidentiality — Article 5(1)(f)
Processing must be conducted with appropriate technical and organisational measures to ensure security of personal data. "Appropriate" is assessed on a risk-based basis, directly linked to Article 32.
Encryption at rest and in transit
Robust access controls and least-privilege principles
Incident response and breach notification procedures
Protection against accidental loss or destruction
The Accountability Principle
Article 5(2)
The controller is responsible for, and must be able to demonstrate compliance with, all six substantive principles. This marks a fundamental shift from formal compliance to demonstrable governance—the burden of proof sits squarely with the controller.
Article 30 Records
Maintained records of processing activities as the documentary backbone of accountability.
DPIAs
Data Protection Impact Assessments for high-risk processing operations, evidencing proactive risk management.
Governance Frameworks
Policies, procedures and internal standards that embed data protection by design and by default.
Training & Audits
Regular staff training and independent audits to demonstrate ongoing, operational compliance.
Article 5 Compliance Controls
The following twenty controls span all six substantive principles and the accountability obligation under Article 5(2). Together they form a comprehensive operational compliance framework.

Datari Home