Purpose Limitation
Article 5(1)(b) GDPR — data may only be used for the original purpose
Practitioner's note: This article is practice-oriented compliance documentation, not legal advice. We are a compliance specialist, not a law firm. For legally binding information please consult a licensed lawyer.
TL;DR
Personal data may only be used for the purposes originally specified. A change of purpose (Article 6(4)) is permissible only under strict conditions.
What is purpose limitation?
Practical examples of change of purpose:
- Original: newsletter sign-up — new: marketing call
- Original: job application — new: talent pool for other positions
- Original: customer contact — new: use for AI training
All three constitute a change of purpose — a new legal basis is required (typically: consent).
Practical example
An insurer collects health data for processing applications. The planned use of these data to assess motor vehicle tariffs constitutes a change of purpose — separate consent is required.
Frequently asked questions
When is a change of purpose permissible?
Article 6(4): compatible with the original purpose (compatibility test), or new consent, or a statutory basis.
Does AI training qualify as a change of purpose?
Yes, as a rule. CNIL and BSI confirm: AI training is a separate purpose.
Fine?
Article 83(5)(a) — up to EUR 20 million or 4%.