What do the GDPR's six principles mean at work?

In brief

The six principles in the General Data Protection Regulation's Article 5 are the basic rules for using personal data at work. They mean that personal data must be used lawfully, fairly and openly; only for defined purposes; only as much as needed; kept accurate; kept only as long as needed; and protected properly. For an employee, this affects ordinary choices such as what to write in an email, what to save in a spreadsheet, who can view a file and when old data should be removed. For the organisation, the key point is accountability: the controller must be able to show that the principles are followed.

Principles cover ordinary tools, not only systems

Personal data means information about an identified or identifiable natural person under the General Data Protection Regulation's Article 4. A name can be personal data. So can an identification number, location data or an online identifier if it can identify a person directly or indirectly.

Processing is also broad under Article 4. It covers collecting, recording, organising, storing, changing, retrieving, using, disclosing, combining, restricting, erasing and destroying personal data. It can be automated or manual.

That is why the six principles do not belong only to specialist systems. They also apply to work where people use ordinary tools:

• an email thread about a customer, resident, pupil, patient, job applicant or employee;
• a spreadsheet that lists contact details, absences, complaints or service cases;
• a shared drive folder that contains reports with names or other identifiers;
• a paper list that is used to organise a task;
• a chat message that includes a screenshot with personal data.

The practical question is simple. If a person can be identified from the information, the principles matter before the information is copied, shared, stored or deleted. For more on recognising personal data, see What is personal data, and when does it stop being personal data?.

The six principles show up like this during the workday

The General Data Protection Regulation's Article 5 sets the six principles. They sound abstract, but each one turns into a daily work habit.

Principle in Article 5	What it means in ordinary work
Lawfulness, fairness and transparency	There must be a lawful basis for the use. The use must not surprise the person unfairly. The person must get clear information about the processing where the Regulation requires it.
Purpose limitation	Personal data is collected for a specific, explicit and legitimate purpose. A list made for one service task is not automatically a list for another use.
Data minimisation	The data must be adequate, relevant and limited to what is necessary for the purpose. If a task needs a work email address, it does not automatically need a personal identification number.
Accuracy	Personal data must be accurate and, where needed, kept up to date. If a customer corrects an address or an employee corrects an error, the organisation needs a working way to update it.
Storage limitation	Identifiable personal data is kept only as long as needed for the purpose. A folder should not become a permanent archive just because nobody owns the deletion decision.
Integrity and confidentiality	Personal data must be handled securely. Access should fit the work need, and data should be protected against unauthorised use and accidental loss, destruction or damage.

The table also shows why data protection is not only a legal or information technology topic. A person who creates a list, forwards an email, opens access to a folder or leaves old files in place is making choices that relate to Article 5.

Some data needs extra caution. The General Data Protection Regulation's Article 9 starts from a prohibition on processing special categories of personal data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying a person, health data, and data about a person's sex life or sexual orientation. Article 9 then lists situations where that prohibition does not apply. In everyday work, this means that health information, union membership or similar sensitive information should not be collected or shared just because it would be convenient.

Lawfulness does not mean asking for consent to everything

Lawfulness is the first principle, but it is often misunderstood. The General Data Protection Regulation's Article 6 says processing is lawful only if at least one lawful basis applies.

Article 6 lists these bases:

• consent for one or more specific purposes;
• necessity for a contract with the data subject, or steps before a contract at the data subject's request;
• necessity for the controller's legal obligation;
• necessity to protect vital interests;
• necessity for a task carried out in the public interest or in the exercise of official authority;
• necessity for legitimate interests, unless the data subject's interests or fundamental rights and freedoms override those interests.

Article 6 also says the legitimate interests basis does not apply to processing carried out by public authorities in the performance of their tasks. This matters for municipalities and other public bodies. A public task should not be turned into a consent form if another legal basis is the real basis.

Consent has its place, but Article 4 describes consent as a freely given, specific, informed and unambiguous indication by which the data subject accepts the processing. In normal work, this means consent is not a shortcut for every situation. If a service, employment process or statutory task cannot realistically work without the processing, the organisation needs to identify the correct Article 6 basis instead of treating consent as a default.

Purpose limitation also connects to lawfulness. Article 6(4) says that when personal data is later used for a different purpose, and the new use is not based on consent or on Union or Member State law that is a necessary and proportionate measure in a democratic society to safeguard an objective listed in Article 23(1), the controller must consider factors such as the link between the original and later purposes, the context of collection, the nature of the data, possible consequences for people and safeguards such as encryption or pseudonymisation.

Transparency means clear information and a working route for requests

Transparency is not only a privacy notice on a website. The General Data Protection Regulation's Article 12 requires information to be concise, transparent, easy to understand, easily accessible and in clear and plain language, especially when addressed to a child.

Articles 13 and 14 explain what information must be provided when data is collected from the person or from another source. This includes the controller's identity and contact details, the purposes and legal basis, recipients or categories of recipients, retention time or criteria, relevant rights, and information about automated decision-making including profiling where it exists.

In daily work, transparency has two sides.

First, the organisation must be able to explain what it does with personal data. A process owner cannot rely on vague wording if staff do not know why the data exists, who receives it or how long it is kept.

Second, employees need a route for requests. Article 12 says the controller must facilitate the exercise of rights under Articles 15 to 22. Article 12 also sets the response time: information on action taken must be provided without undue delay and in any event within one month of receiving the request. The period may be extended by up to two further months where necessary, taking into account the complexity and number of requests, and the person must be told about the extension within one month.

The rights covered in Articles 15 to 20 include access, rectification, erasure, restriction and data portability. For practical handling of requests, see Data subject rights: when a customer asks for their data, you have a month.

Security is one of the principles, not an extra add-on

The sixth principle in Article 5 is integrity and confidentiality. It requires appropriate security for personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Technical measures are not the whole answer. Organisational measures matter too. A shared mailbox, a group permission, a paper archive rule, a deletion routine and a habit of checking recipients before sending an email all affect whether the principle is followed.

The General Data Protection Regulation's Article 4 defines a personal data breach as a security breach that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. In ordinary terms, this can include a message sent to the wrong recipient, a lost device with personal data, a file opened to the wrong group or data changed by mistake.

Article 33 requires the controller to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms. A processor must notify the controller without undue delay after becoming aware of a breach.

Article 34 adds a separate duty to communicate the breach to the data subject without undue delay when the breach is likely to result in a high risk to natural persons' rights and freedoms. For a focused explanation, see Personal data breach: the 72 hours start when an employee notices.

The principles do not solve everything automatically

The six principles are the starting point, not an automatic answer to every case.

They do not by themselves tell the exact retention period for every document. Article 5 says identifiable data is kept only as long as necessary for the purposes, and Articles 13 and 14 require retention information or retention criteria. The organisation still has to define those purposes and criteria for its own processes.

They do not make every data subject request valid in full. Article 17 gives a right to erasure in specific situations, but it also lists situations where erasure does not apply, such as where processing is necessary for a legal obligation, a public-interest task, public authority, certain public health reasons, certain archiving, research or statistical purposes, or legal claims.

They do not remove the need to identify roles. Article 4 distinguishes the controller, which determines the purposes and means of processing, from the processor, which processes personal data on behalf of the controller. When a supplier handles personal data, the role question matters. More on that issue is covered in Controller or processor: when a data processing agreement is needed and what Article 28 requires.

They also do not make special categories of personal data ordinary. Article 9 starts from a prohibition and then gives exceptions. A lawful basis under Article 6 is not enough on its own for Article 9 data if no Article 9 condition applies.

Accountability makes the principles a management issue

Article 5 makes the controller responsible for compliance with the principles and for being able to demonstrate that compliance. This is the accountability duty.

Accountability turns principles into management questions. The organisation needs to know which personal data it processes, for what purpose, on what basis, who can access it, how long it is kept and how rights and breaches are handled.

Evidence also matters. If a supervisory authority or customer asks how staff know the rules, the organisation needs more than a policy file. It needs a way to show that relevant employees have been trained for the work they actually do.

In practice, accountability is built from several parts:

• clear ownership of processes that use personal data;
• instructions that match the tools employees use;
• access rights that follow work roles;
• routines for correction, deletion and restriction;
• a route for data subject requests;
• a route for suspected personal data breaches;
• records that show training and follow-up.

The six principles are therefore not just legal language. They are a practical checklist for daily decisions and a management framework for proving that those decisions are controlled.