Data Protection Principles

6 Principles of GDPR (article 5)

These 6 principles give a top level overview of the areas covered by the new regulation, however they do not delve into the various sub sections and many other articles of GDPR, nor do they cover the issues around data flow mapping, DPIA’s and suggested policies for implementing a programme to meet GDPR compliance.

Of note should be the requirement for accountability Article 5 (2) which compliments the transparency principle below and requires you to demonstrate that you comply with the principles below (privacy by design and privacy by default being methods to achieve this)…

1. Processed lawfully, fairly and in a transparent manner.

Lawfulness (article 6) relates to matters around consent, performance of a contract, legal obligations, protection of individuals and/or public interest.

Fairness and transparency relate to the conditions which you have provided the individual as justification for keeping their data. These are covered within your policies (privacy, security, retention) and any contracts entered in to.

2. Collected for specified, explicit and legitimate purposes.

Also described as “purpose limitation”- you can only obtain the information for the reasons that you have explicitly detailed on your notices/policies. Do not process data for anything other than what you have clearly described without further consent.

3. Adequate, relevant, and limited to what is necessary.

Also known as “data minimisation” – essentially, you should collect/hold no more data that is necessary for the purposes of the processing you have set out

4. Accurate and, where necessary, kept up-to-date.

It is your responsibility to ensure that the records you keep must be kept up to date to maintain compliance; this requires you to have policies that regularly comply with your policies and these conditions.

5. Retained only for as long as necessary.

Kept in a form which permits identification for no longer than is necessary for the purpose for which it was obtained.

6. Processed in an appropriate manner to maintain security.

This covers physical and technical access security as well as protection against accidental loss, destruction/damage, unlawful processing.

Article 5(2) requires that “the controller shall be responsible for, and be able to demonstrate, compliance with the principles.”