Purpose limitation

Purpose limitation anchors every other principle: necessity, retention and the choice of lawful basis are all judged against a declared purpose. GDPR Art. 5(1)(b) requires purposes to be specified, explicit and legitimate before collection, and Art. 6(4) lists factors for deciding whether a new purpose is compatible with the original one: the link between purposes, the context and reasonable expectations, the nature of the data, possible consequences and safeguards such as encryption or pseudonymization. The LGPD splits the idea into the principles of purpose and adequacy (Art. 6, I and II).

The principle is often tested when organisations want to reuse data. Repurposing is not forbidden, but an incompatible new purpose needs its own lawful basis and transparency towards the individuals concerned.

AI makes this concrete. Support tickets collected to resolve customer problems may later be wanted for training a language model. The team must assess compatibility, update notices, consider pseudonymization and record the decision in the record of processing activities.