Purpose Limitation
What is Purpose Limitation?
The principle that personal data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. A core principle under GDPR Article 5(1)(b).
Terms that appear alongside purpose limitation
Each of these is named in at least one of the same controls as purpose limitation. The number is how many controls name both.
- consent 48 shared controls
- data minimisation 40 shared controls
- lawful basis 30 shared controls
- gdpr 23 shared controls
- data subject 22 shared controls
- confidentiality 19 shared controls
- compliance 18 shared controls
- transparency 18 shared controls
Frameworks that govern purpose limitation
What the standards actually require on purpose limitation
Requirements naming purpose limitation across 6 standards, quoted from the control text.
Purposes must be determined, explicit, legitimate and communicated to the data subject, and data may not be processed for other purposes unless a new lawful basis applies.
ley-org-nica-de-protecci-n-de-datos-personales-lopdp::10(d) · Art. 10(d): purpose limitation and compatible further processing →Art.12 fairness and transparency; Art.13 purpose limitation; Art.14 accuracy; Art.15 storage limitation - personal data shall be kept for no longer than is necessary for the purposes for which it is processed.
ETH-PDPP-Art.12-15 · Fairness/transparency, purpose limitation, accuracy, storage limitation →Sections 4-7 of DPDP Act 2023 establish the foundational lawful processing framework. Section 4 Grounds for Processing Personal Data: a person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful...
DPDP-Scope-2023-Sec5-NoticeConsent-LawfulProcessing-PurposeLimitation-DataMinimisation · DPDP Act Sections 4-7 + Notice + Consent + Lawful Processing + Purpose Limitation + Data Minimisation + Legitimate Uses + Sec 4 Lawful Use + Sec 5 Notice + Sec 6 Consent + Sec 7 Legitimate Uses →Processing must be necessary, fair and lawful; data are collected for specified, explicit and legitimate purposes and not further processed incompatibly, considering data subjects' reasonable expectations and applicable law.
zimbabwe-data-protection-act-2021::s.8-9 · Necessity, fairness and purpose limitation →Collection must be for determined, explicit, and lawful purposes. Data cannot be used for purposes incompatible with those for which it was collected.
AR-25326-ART4-PURPOSE · Lawful Purpose and Purpose Limitation →Collect only data necessary for declared purposes and do not process for incompatible new purposes without further lawful basis.
AM-DPA-09 · Data Minimisation and Purpose Limitation →Questions people ask about purpose limitation
What is Purpose Limitation?
Why is Purpose Limitation important for compliance?
Which compliance frameworks address Purpose Limitation?
Where can I learn more about Purpose Limitation?
See how Purpose Limitation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.