Basics 3 minutes read

Collected for what? The question stays binding

Under Article 5(1)(b) GDPR data is collected for specified, explicit and legitimate purposes – and may not later be processed in a manner incompatible with them. The purpose is therefore not a label attached at collection time but a tie that persists.

The Regulation demands three properties of a purpose, and all three are regularly underrated. Specified means: determined before collection, not after. Explicit means: worded so that its reach is recognisable – "to improve the service" fails that, because almost anything would fit under it. Legitimate means: backed by a legal basis under Article 6 and not in breach of other law.

The third point is often overlooked because purpose and legal basis get treated as the same thing. They are not: the purpose describes what processing is for, the legal basis why it is permitted. A purpose without a legal basis stays unlawful; a legal basis without a defined purpose cannot be examined at all.

When further processing is compatible

Purpose limitation does not forbid a second use. It only requires the second to be compatible with the first – and Article 6(4) sets out five considerations for that assessment. A negative outcome does not rule the further processing out for good; what it then needs is its own legal basis, as a rule a separate consent.

The five considerations of the compatibility test

  1. Link between the old and the new purposeThe closer the substantive connection, the more likely compatibility.
  2. Context of the collectionAbove all the relationship between the parties and the expectation it shapes.
  3. Nature of the dataFor special categories under Article 9 and for criminal data the test is markedly stricter.
  4. Possible consequencesWhat the further processing concretely means for the data subject – this is where the test most often tips.
  5. Safeguards in placeEncryption and above all pseudonymisation, which the Regulation names expressly.
No single point decides on its own; together they form a picture. In practice the assessment most often tips at the fourth point – the consequences of further processing tend to be felt precisely where they no longer have anything to do with the original occasion.

Two cases that resemble each other and yet end differently

The same postal address, two further uses

Regularly compatible
Regularly incompatible
Address from an order, used for the return of the same goods
Address from an order, used for sending a catalogue
Access logs from operations, examined after an intrusion attempt
Access logs from operations, examined to assess work performance
Order history, analysed statistically for stock planning
Order history, analysed for individual pricing
The difference lies not in the data but in the expectation the collection situation created. An address given for a delivery is obviously usable for handling that delivery – for an advertising mailing months later it is not, without more.

For running a website purpose limitation has a very practical consequence: the purposes in the banner and the purposes in the privacy notice describe the same facts and therefore have to match. Where they diverge, at least one of the two statements is wrong – and which one is decided not by the wording but by what the system actually does.

Published 19 October 2026

This article explains general principles and does not replace legal advice on an individual case.

Read next

Back to the overview