Art. 5 GDPR – Principles relating to processing of personal data
Personal data shall be:
processed lawfully, fairly and in a transparent manner in relation to the data subject lawfulness, fairness and transparency
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes purpose limitation
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed data minimisation
accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay accuracy
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject storage limitation
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures integrity and confidentiality
The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 accountability
In shortArticle 5 GDPR sets the seven principles every organisation must follow when handling personal data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Breaching Article 5 carries the highest GDPR fine tier – up to €20 million or 4% of global annual turnover.
| Chapter | Chapter 2 – Principles (Art. 5–11) |
| Applies to | Every controller processing personal data of people in the EU/EEA; processors indirectly via Art. 28 |
| Maximum fine | €20.000.000 or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)(a)) |
| In force since | 25 May 2018 |
| Explained by recitals | 39, 40 |
| Closest UK equivalent | UK GDPR Art. 5 (identical wording) |
The seven principles of Article 5 explained
Article 5(1) lists six principles and Article 5(2) adds accountability, making seven in total. Each principle imposes a concrete obligation on the controller.
| Principle | What it means | What you must have in place |
|---|---|---|
| 1. Lawfulness, fairness, transparency Art. 5(1)(a) | Every processing activity needs a legal basis (Art. 6) and people must be told about it in plain language. | Documented legal basis per activity; privacy notice meeting Art. 13/14 |
| 2. Purpose limitation Art. 5(1)(b) | Collect data for a stated purpose; do not reuse it for something incompatible. | Purpose recorded per activity in the ROPA (Art. 30); compatibility test for new uses |
| 3. Data minimisation Art. 5(1)(c) | Only collect and keep the data actually needed for the purpose. | Field-level review of forms and systems; justification for each data category |
| 4. Accuracy Art. 5(1)(d) | Keep data correct and current; fix or delete inaccurate data promptly. | Rectification process (Art. 16); periodic data quality checks |
| 5. Storage limitation Art. 5(1)(e) | Do not keep identifiable data longer than the purpose requires. | Retention schedule with deletion triggers, applied per system |
| 6. Integrity and confidentiality Art. 5(1)(f) | Protect data against loss, misuse and unauthorised access. | Security measures under Art. 32; access control; breach procedure (Art. 33) |
| 7. Accountability Art. 5(2) | The controller must be able to prove compliance with all of the above. | ROPA, DPIAs, policies, training records, DPO where required (Art. 37) |
Fines issued under Article 5
Article 5 is the most-cited article in GDPR enforcement because almost every breach also violates a principle. Selected decisions:
| Organisation | Authority | Date | Fine | Principle breached |
|---|---|---|---|---|
| Clearview AI | CNIL (France) | Oct 2022 | €20.000.000 | Lawfulness – facial images scraped without legal basis |
| Meta Platforms Ireland | DPC (Ireland) | May 2023 | €1.200.000.000 | Lawfulness – transfers to the US without adequate safeguards |
| Free Mobile | CNIL (France) | Dec 2022 | €300.000 | Integrity and confidentiality; accuracy |
| Deutsche Wohnen | Berlin DPA (Germany) | Oct 2019 | €14.500.000 | Storage limitation – tenant data kept without deletion routine |
All Article 5 enforcement cases
Recitals that explain Article 5
Recitals are not binding, but courts and authorities use them to interpret the article.
- Recital 39 – Principles of data processing
Explains transparency, minimisation, storage limitation and security, and requires that processing be “reasonably expected” by the data subject. - Recital 40 – Lawfulness of data processing
Confirms that processing is lawful only with consent or another legal basis set out in the Regulation or in EU/Member State law.
What Article 5 requires in practice
Under Art. 5(2) the controller must be able to demonstrate compliance. Supervisory authorities typically expect the following documentation:
- Maintain a record of processing activities (ROPA) with purpose, legal basis, data categories and retention per activity
- Publish a privacy notice that matches the ROPA
- Run a DPIA for high-risk processing (Art. 35)
- Apply a retention schedule with automated deletion
- Document security measures and test them
- Keep evidence: policies, training logs, DPIA outcomes, vendor DPAs
Frequently Asked Questions about Article 5
+ What are the seven principles of the GDPR?
Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. The first six are in Article 5(1)(a)–(f), the seventh in Article 5(2).
+ What is data minimisation under Article 5?
Data minimisation (Art. 5(1)(c)) requires personal data to be adequate, relevant and limited to what is necessary for the stated purpose. In practice: do not collect a field you cannot justify.
+What is the maximum fine for breaching Article 5?
Up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(5)(a)). Article 5 sits in the upper fine tier.
+Does Article 5 apply to processors?
Article 5 addresses controllers. Processors are bound indirectly through the Article 28 contract and directly through Article 32 (security). Authorities have fined processors for security failures that also breached Art. 5(1)(f).
+How is Article 5 different from Article 6?
+How long can personal data be stored under Article 5?
No fixed period. Art. 5(1)(e) requires deletion or anonymisation once the purpose is fulfilled, unless a legal retention obligation applies. Controllers must set and document a retention period per purpose.