Article 5

Principles of processing personal data

• 1

  Personal data must be :

  • a

    are processed in a manner which is lawful, proper and transparent with respect to the data subject ("lawfulness, proper and transparency");

  • b

    are collected for specified, explicit and legitimate purposes and may not subsequently be further processed in a manner incompatible with those purposes; further processing for archiving in the public interest, scientific or historical research or statistical purposes shall not be considered incompatible with the original purposes in accordance with Article 89(1) ("purpose limitation");

  • c

    adequate, relevant and limited to what is necessary for the purposes for which they are processed ("minimal data processing");

  • d

    are accurate and updated as necessary; all reasonable steps must be taken to promptly delete or rectify ("accuracy") personal data that are inaccurate in relation to the purposes for which they are processed;

  • e

    be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data are processed purely for archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89 (1), provided that appropriate technical and organizational measures required by this Regulation are taken to protect the rights and freedoms of the data subject ("storage limitation");

  • f

    processed by taking appropriate technical or organizational measures in such a way as to ensure their appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage ("integrity and confidentiality").

• 2

  The controller is responsible for compliance with paragraph 1 and can demonstrate it ("accountability").