7 Principles of GDPR
Article 5 (opens in a new tab) of GDPR covers the seven core principles of privacy law your business must follow to legally collect and process the personal data of EU citizens. Implementing these principles is the first step your business should take toward GDPR compliance. This page will go over each principle in more detail.
Lawfulness, Fairness, and Transparency
Under GDPR, personal data should be processed lawfully, fairly, and transparently. In order to process personal data lawfully, businesses must identify a legal basis for processing data. These reasons are specified in Article 6 (opens in a new tab) of GDPR.
Purpose Limitation
Businesses should only collect and process personal data for a specific business purpose. These purposes must be clearly communicated to consumers. Users' personal data must also not be processed for any other reason than what they consented to.
Data Minimisation
Businesses should limit the amount of data it collects and stores to avoid potential data misuse. Your business should only collect data that is relevant and necessary for a specific business purpose. Once the purpose has been fulfilled, it should be properly disposed in a secure and timely manner.
Accuracy
Personal data collected by your business should reasonably be correct, kept up-to-date, and complete. This can be maintained through users' right to rectification. If your business stores incomplete or inaccurate data, it serves no purpose and should be disposed of in a secure manner.
Storage Limitation
This principle closely relates to data minimization. Users' personal data should not be kept for longer than necessary. Keeping more data than necessary increases the risk of potential data misuse. If the data has already fulfilled its business purpose, it should be disposed of in a secure and timely manner.
Integrity and Confidentiality
Your business should process users' personal data in a manner that protects it against unauthorized access and unlawful processing. Make sure your business limits data access and authorization to only the people in your organization who need it.
Accountability
Businesses are responsible for ensuring that it complies with GDPR’s principles and regulations. You must be able to demonstrate compliance through proper records and documentation. We'll go over the specific kinds of records and documentation to provide later in this guide.